If you take a look at Compose.pm, line ~149, you'll see:
The filename there should be escaped, so it should be:
Adrian
Code:
$write = "$attchdir/" . ($_->{msgdata_suggestedname} || $i++);Code:
$write = "$attchdir/" . $IN->escape($_->{msgdata_suggestedname} || $i++);Adrian