http://sourceforge.net/projects/ajax-explorer/
Works.
Secure? Who knows.
Just had a client ask for this.
Unfortunately, the other part of the requirement was the ability to move image files around and reorganize in folders without breaking any links to those images on the site. That adds, shall we say, a little to the difficulty of the problem.
>move image files around and reorganize in folders without breaking any links to those images on the site.
The now-unsupported clientside, static-page writing Citydesk cms did this for images, pages, and/or page segments by assigning an ID number to it. As long as you call it by the ID, nothing breaks.