Searched for "ampersand breaks imagecache" and ultimately found this module. An & (and probably other special characters) makes a perfectly valid uploaded file but does not show up in that file's imagecache manipulations.
Provides a central transliteration service to other Drupal modules, and sanitizes file names while uploading.