Windows filesystem does not allow to use character "?" for filenames.
"path?query" would be "path@query" or something (like wget for Windows).
As a matter of fact, mechanize should escape/replace more and more characters for saving files to disk (see: wget and cURL and Content-Disposition Security Advisory), but I think it is just another （big） issue.
Found this advisory for curl: http://curl.haxx.se/docs/adv_20101013.html
Strip path information from content-disposition filename per RFC 2183…
… 2.3. Issue #163
Escape windows special file names. Issue #163
Extended special filename detection to all filenames. Issue #163
Escape special characters for Windows filesystems. Issue #163
Remove windows path separators from content-disposition filename. Issue
Disallow low ASCII characters in content-disposition filename. Issue #…
Parse Content-Disposition (mostly) per RFC 2183. Issue #163
Add mention of fix of Issue #163
Other than writing a non-existent special dot-file when mechanize is used in the home directory I think I can close this issue. Mechanize already avoids overwriting existing files when saving files (so you can't overwrite .login, etc.)
I am anxiously awaiting pre-release/2.1 version.