Filenames with '+' characters in them could not be served unless encoded

The requested path was being URL-decoded with unescape(), but that function does a '+' to ' ' (space) conversion.
The '+' to space decoding is supposed to occur for the "query" portion of the URL only, not the "path" portion.
Use the new hex_decode() function instead of unescape() for "path" decoding.