It could conceivably leak the key and/or data being sent. If the key is random, leaking it does not expose unrelated data; and if you're uploading via HTTPS, exposing the key does not even expose the protected data unless the attacker also has access to S3.

Data-dependent timings could conceivably allow a bad guy to deduce something about the data being sent.

Note that this is all highly speculative; I'm not convinced it's truly impossible, but it's one of those attack scenarios where "put a gun to the sysadmin's head" begins to look like a pleasant and trouble-free option...