I suggest you use Fiddler2 or some similar tool to examine and compare messages that come out with twitteroauth, as well as with tmhOAuth. You will see the difference.
In my experience, that is exactly what HTTP POST for Twitter looks like using update_with_media. {XML, JSON}. I suppose the suffix you use only affects the answer. (Your application should set the authorization header in a way that is specific to your application.)
You want twitteroauth to post something like the following
POST https://upload.twitter.com/1/statuses/update_with_media.xml HTTP/1.1 Authorization: OAuth oauth_callback="oob", oauth_consumer_key="xxxxxxxxxxxx", oauth_nonce="7774328k", oauth_signature="pUYjRnccmrBYiO1j9cliETsw%2B5s%3D", oauth_signature_method="HMAC-SHA1", oauth_timestamp="1318300521", oauth_token="59152613-vrlZ2edX56PudQtBmpAWd3SPDt9cPyAhibO7ysl6W", oauth_version="1.0" Content-Type: multipart/form-data; boundary=======c49479438c600bf59345e====== Host: upload.twitter.com Content-Length: 7320 Connection: Keep-Alive --======c49479438c600bf59345e====== Content-Disposition: form-data; name="status" working on a Tweet tool that uses the OAuth Manager library. --======c49479438c600bf59345e====== Content-Disposition: file; name="media[]"; filename="ThisIsAPicture.png" Content-Type: image/png ...binary png data here... --======c49479438c600bf59345e======--
Cheeso
source share