Re: Is there any critical risk or any other problem if the previous bp-core-avatars.php is used ?
Have a similar problem 
Prev. installation WP 3.0 and BP 1.2.4.1
Upgraded to BP 1.2.5
In the blog comments of the blog with id 2 I got some warnings:
Warning: file_exists() [function.file-exists]: open_basedir restriction in effect. File(/is/htdocs/my-account-name/my-domain/www/wp-content/blogs.dir/1/files//avatars/3) is not within the allowed path(s): (/is/htdocs/user_tmp/my-account-name:/tmp:/dev/null:/dev/urandom:/bin:/usr:/is/default.errors:/is/htdocs/my-account-name) in /is/htdocs/my-account-name/my-domain/www/wp-content/plugins/buddypress/bp-core/bp-core-avatars.php on line 150
The Problem is, that there is no directory /wp-content/blogs.dir/1 in my installation! Besides the main blog I created only a second one (/wp-content/blogs.dir/2).
If I copy bp-core-avatars.php from BP 1.2.4.1 in my 1.2.5 installation the waring is gone! But this does not seem to be a proper solution because there a some changes in the php file …
My solution, which I found some where else in this forum: I put the following two lines in /wp-content/plugins/bp-custom.php:
define( ‘BP_AVATAR_URL’, ‘http://’ . $_SERVER . ‘/wp-content/uploads’ );
define( ‘BP_AVATAR_UPLOAD_PATH’, $_SERVER . ‘/wp-content/uploads’ );
The warning is gone 
