Do we know for sure an .htaccess file is involved? Maybe the permissions are just wrong on the attachment directory for RoundCube. I'll look when I get some time this weekend. If you can figure out what the problem is, please post here. I'll try reproducing that soon.
Thanks