A Windows path can be composed of no more than 256 characters, including the c:\.

in a web application javascript should never be your only validation. it can be disabled in any browser.