This is a nice summary: http://en.wikipedia.org/wiki/Filename#Comparison_of_filename_limitations

I suggest we *definitely* avoid the following characters in filenames:

\0-\x1F (ASCII control characters)
\x7f (ASCII control character)
/
\
:

And, probably we should avoid these as well (because they're not valid in NTFS filenames unless they're in the POSIX namespace, which they won't be)

"
*
<
>
?
|

I think I was wrong about %, though. Seems you can have that in a filename on basically every filesystem known to man.

Also, we should probably allow "." in filenames preceeding the final "." separating the extension. So we should allow "foo.bar.png" I don't *think* your parser currently allows that.