In Oracle JDeveloper 11g R1 (I did not test 11g R2) the file upload component is submitted even if users click a cancel button with immediate="true" set. Usually, immediate="true" on a command button by-passes all modle updates, which would make you think that the file upload isn't processed either. However, using a form like shown below, pressing the cancel button has no effect in that the file upload is not suppressed.

<af:form id="f1" usesUpload="true">      
  <af:inputFile label="Choose file" id="fileup" clientComponent="true"
                value="#{FileUploadBean.file}"  valueChangeListener="#{FileUploadBean.onFileUpload}">
  </af:inputFile>
  <af:commandButton text="Submit" id="cb1" partialSubmit="true"
                    action="#{FileUploadBean.onInputFormSubmit}"/>
  <af:commandButton text="cancel" id="cb2" immediate="true"/>
</af:form>

The solution to this problem is a change of the event root, which you can achieve either by setting i) partialSubmit="true" on the command button, or by surrounding the form parts that should not be submitted when the cancel button is pressed with an ii) af:subform tag.

i) partialSubmit solution

<af:form id="f1" usesUpload="true">    
  <af:inputFile .../>
  <af:commandButton text="Submit" .../>
  <af:commandButton text="cancel" immediate="true" partialSubmit="true" .../>
</af:form>

ii) subform solution

<af:form id="f1" usesUpload="true">
  <af:subform id="sf1">
    <af:inputFile ... />
    <af:commandButton text="Submit" ..."/>
  </af:subform>
  <af:commandButton text="cancel" immediate="true" .../>
</af:form>

Note that the af:subform surrounds the input form parts that you want to submit when the submit button is pressed. By default, the af:subform only submits its contained content if the submit issued from within.