+15  A: 

Since asking the question, I've found that the bug is in ASP.NET proper, not IIS or ASP.NET MVC, meaning that there's no way to work around it. The only solution is to manually forbid URLs matching these names and these names followed by a period and random characters.

Benjamin Pollack
Yup. :) The ASP.NET team is aware of this bug and is looking into it for ASP.NET 4. Can't guarantee if it will be fixed, but at least there is interest in making this better for developers.
Levi
+3  A: 

For a similar reason, there can't be a web.config tag in StackOverflow.

http://stackoverflow.uservoice.com/pages/1722-general/suggestions/98871-web-config-tag-404-error

Dennis Palmer
A: 

for another similar reason you can't have urls with a dot and a slash http://stackoverflow.com/questions/294495/semantic-urls-with-dots-in-net

Jokin
+10  A: 

This has been addressed in ASP.NET 4. http://haacked.com/archive/2010/04/29/allowing-reserved-filenames-in-URLs.aspx

You can apply a setting in web.config that relaxes this restriction.

<configuration>
  <system.web>
    <httpRuntime relaxedUrlToFileSystemMapping="true"/>

    <!-- ... your other settings ... -->
  </system.web>
</configuration>

Hope that helps.

Haacked
Thanks Phil! I wonder why its not the default in .net 4.
thekaido
@thekaid: Backwards compatibility: MS cannot be certain no-one depends on the old behaviour.
Richard
@thekaido What Richard said is exactly right. You'd be surprised at the types of bugs people start to rely on.
Haacked