Give up on trying to cope with sane filenames; just sanitize them at upload instead. Everyone is happy.