Files with & in file name

One of our illustrious users has & characters in some of their file names. I've checked the input filter type and it's set to Full HTML, which doesn't have HTML filter or HTML corrector turned on. Yet when you try to download the file, the file name path comes out with an = at the end of it like it's trying to split at the & and turn the last part of the file name into an empty CGI variable. The download fails since it can't open the weird file.

In addition, at least in konqueror, when you go to save the file the name that is automatically provided is a number rather than the file name, and that seems to be true regardless of whether there's a number in the name or not.