The server-side upload code let him put it somewhere where PHP was enabled. So he "started" it by just going to its URL.