Users need “Edit Item” permissions in order to use the attachment functionality of web-based InfoPath 2007 forms on MOSS 2007.

I thought “Contribute” would have been enough, but the Attach a File button is grayed out when this is the case. You can see the difference, as subtle as it is, in the image below.

subtle-difference