This is the way the security infrastructure was designed. Even if someone has the ability to run a system stored procedure or extended stored procedure (which is what is used to populate the GUI in Management Studio), they will only see the Windows resources which their account has the authority to see in the first place. They can see the directories and files when you add them to the sysadmin group, because the sysadmin group's Windows authoirty is mapped to the Windows security credentials of the SQL Server service account which therefore allows them to then see any Windows resources which the SQL Server service account has access to.
What you should do is grant then CREATE DATABASE permission along with adding a SQL Server credential which has the authority to view the directory which the files are being uploaded to. Then map the credential to the user's login. The following BOL article will help. ms-help://MS.SQLCC.v9/MS.SQLSVR.v9.en/udb9/html/81c632cc-9d6c-486f-8590-4819517e6006.htm