I'm not so sure it's actually a bug, there is no official RFC for Content-Disposition in HTTP - it is defined in an RFC for MIME messages (RFC 1806). Most browsers generally support it though. Here is a header khttpd returns for a download request:

HTTP/1.1 200 OK
Connection: close
Accept-Ranges: bytes
Content-Length: 301449
Content-Type: audio/mpeg
Content-Disposition: attachment; filename=They Might Be Giants - Doris Cunningham.mp3

I have a suspicion that if all spaces in the filename were converted to underscores (like we do in the web interfaces) it would work fine in Mozilla.