When using io-form, io-upload-iframe, and querystring modules to upload a file, the _addData function of io-upload-iframe will throw a TypeError (object has no method 'split').

The root of the problem is in io-base's send function. If you look at the code below, you can see why

            d = c.data;


// Serialize an object into a key-value string using

            // querystring-stringify-simple.

            if (L.isObject(d)) {

                d = Y.QueryString.stringify(d); //!!! <-- d is not assigned back to the config before io.upload is called

            }

            

            if (c.form) {

                if (c.form.upload) {

                    // This is a file upload transaction, calling

                    // upload() in io-upload-iframe.

                    return io.upload(o, uri, c); //!!! <-- c still has the object, not the string.

                } 

                else {

                    // Serialize HTML form data into a key-value string.

                    d = io._serialize(c.form, d);

                }

            }

As you can see, when passing a data object into the config of io.send, it is converted to a string, but that string is not reattached to the config object before io.upload is called. upload assumes
that the property has already been converted into a string and blindly tries to do a split on said string, but since it is still an object, we get a TypeError:

        _addData: function(f, s) {

            var o = [], 

            m = s.split('='), //!!! <-- TypeError: s is still an object, not a string

            i, l;

It looks like this functionality was broken by commit 68b67a7ca77bd6e51a6d67602d38a4cceede1676

For reference, here is a partial stack trace:
Y.mix._addData() at io-upload-iframe.js:58
Y.mix._upload() at io-upload-iframe.js:246
Y.mix.upload() at io-upload-iframe.js:287
IO.send() at io-base.js:594
Y.io() at io-base.js:716