Linux could learn something about filenames here.

Personally I would also disallow anything below 32 to avoid having filenames contain escape sequences.

I have absolutely no need for a filename that contains an escape character, and would see this as a major bug, like his description of SQL injection. Better to fail fast.