if the method throws an illegal argument exception, that would have to be handled by the user as well, otherwise the http connetion will just stay.
I would argue for error 403 since that is the same behaviour as Apache http if directory browsing is disabled.