The limit for retrieving files via standard APIs

I see you are using Viusalforce and I feel you are messing with Session ID .I tested below code and works in my org

<apex:page standardController="Case">
<p>
    Select a file to upload.
</p>
<input type="file" id="file" onchange="upload()"/>
<p id="message"></p>
<script src="{!$Resource.forcetk}"></script>
<script src="//code.jquery.com/jquery-1.11.2.min.js"></script>
<script>

var client = new forcetk.Client();
client.setSessionToken('{!$Api.Session_ID}');

    function upload() 
    {
        var file = document.getElementById("file").files[0];
        client.createBlob('ContentVersion', {
            Origin: 'C', 
            PathOnClient: file.name
        }, file.name, 'VersionData', file, function(response){
            console.log(response);
            document.getElementById("message").innerHTML = "File uploaded: <a href=\"/" + response.id +
                "\">Take a look!</a>";
        }, function(request, status, response){
            console.log(response);
            document.getElementById("message").innerHTML = "Error: " + status;
        });
    }
</script>

Two things I did differently

1. The Session Id can be easily obtained using global merge field {!$Api.Session_ID}
2. I included jquery library as the whole set up needs jquery library to function properly

You Can create ContentVersion more than 25MB using AJAX Toolkit i.e, sforce object.

Please find the official documentation here

Below is the sample code to create an account record:

var account = new sforce.SObject("Account");//Similarly can be created for ContentVersion
account.Name = "my new account";//Give Required Fields
var result = sforce.connection.create([account]);

if (result[0].getBoolean("success")) {
  log("new account created with id " + result[0].id);
} else {
  log("failed to create account " + result[0]);
}