As you are saying, you can do this in share.
Many operations in share is done using javascript calls, so instead of looking for the whole page defintion/build server side, we go directly to client side javascripts.
In this case webapps/share/components/profile, and the file profile.js.
Side note: a good way to find out what is going on is to use httpfox plugin in firefox. It will list all http request and json data so you can easily track down what is going on.
In profile.js you will find that it calls slingshot/profile/uploadavatar webscript for the upload. That is serverside webscript, and their location is
/webapps/alfresco/WEB-INF/classes/alfresco/templates/webscripts/org/alfresco/
Navigate to slingshot/profile/ subdirectory, in there you will find uploadavatar.js, and in there you can probably find you answer.
Hope this helps, I know it was not to detailed in how to find what code runs what, but may be a starter.