[eluser]richthegeek[/eluser]
check lines 108-115 in the Upload.php file - the function is called by the variabled $method.
The method_exists() function checks all CI instance methods to see if there is a match, I guess, although im not sure 100% how this works.
Whilst is set_allowed_types() is never called explictly (that is, a search will never show it up) as long as that function exists, it will work.
To be honest itst just lazy and clever coding on the part of the dev.