I've had a couple clients override the page file name under "page settings" and include the "&" symbol. This blows up the page and displays "bad request". It's a little tricky to fix in the database and then create a new URL mapping.

Any chance on page save you can strip out special characters like that? I know there's some client-side checking going on there but as mentioned, two clients (on Macs) have been able to override that and save with a file name like "Mike&Johns-bar-and-grill.aspx". Then BOOM, blown up page.