One extremely ugly way to resolve this is have the user manually type the directory into a text box, and add this back to the front of the file value in the JavaScript.
Messy... but it depends on the level of user you are working with, and gets around the security issue.
<form>
<input type="text" id="file_path" value="C:/" />
<input type="file" id="file_name" />
<input type="button" onclick="ajax_restore();" value="Restore Database" />
</form>
JavaScript
var str = document.getElementById('file_path').value;
var str = str + document.getElementById('file_name').value;