readdir's ordering is filesystem-dependent. On many systems, that means it might as well be random. People uploading archives will reasonably expect the files to appear in alphabetical order, so we should make sure they do.
I guess this one slipped through the cracks when $user was made global.
