If you drag and drop an attachment with an illegal character (like a '+'), it still gets attached but is broken inside of Confluence. We should either (i) prevent you from uploading the file in the first place OR (ii) remove the character restrictions.
We did remove the character restrions for page titles in Confluence 4.1 (see
CONF-9458). Perhaps we can remove the restrictions for attachment names for the same reason.