How to grab query string from wp-content/uploads/.*

The problem, as you noted is with the .htaccess rewrite rules which – in the typical wp htaccess file – exclude physical files and directories from being processed by index.php and got served directly.
I think the solution is in working with .htaccess adding a prioritary rule to let a file with query string being processed by php instead of being served directly and loose the query string. I don’t think such a rule (well restricted to specific cases) may overload the server, you can easily monitor it and decide wether or not to use it:
try this in your .htaccess:

#first condition if the URL contains the path to uploads directories
RewriteCond %{REQUEST_URI}  /wp-content/uploads/ [NC] 

#second condition if specific keys are present in the query string (attr1 OR attr2)
RewriteCond %{QUERY_STRING} attr1= [OR]
RewriteCond %{QUERY_STRING} attr2=

#third condition we need to avoid infinite loop and errror 500, 
#so we check that a specific key (added in our final rewrite rule below) is not present 
RewriteCond %{QUERY_STRING} !loop=no

#the final rule if all above is matched will redirect to index.php and add our 'loop=no' key/value pair to avoid the loop
RewriteRule ^ /index.php?loop=no [L,QSA] 

At this point if you type your url /wp-content/uploads/2012/10/img.png?attr1=foo&attr2=bar you will get 404 not found.
In your plugin function then:

add_action('init','check_attributes');
function check_attributes(){
  if(!empty($_GET['loop']) && $_GET['loop'] =='no'){ //you may add more clause here if needed

    $var1=$_GET['attr1'];
    $var2=$_GET['attr2'];
    // perform your logic with the variables passed to the url
   
    // maybe redirect to the physical file without query vars?
    wp_redirect(strtok($_SERVER["REQUEST_URI"], '?'));
    exit;
  }
}

Hope it may help