Need help with Content-Disposition Content-Type

I am trying to use the following script to allow users to download files
with some of the file name stripped off. This script is for use on my
company intranet and only has to work with Internet Explorer 6. When the
files are uploaded (through another PHP script) they are prefixed with a
timestamp to prevent files with duplicate filenames from overwriting each
other and to maintain a document history. I am actually storing the file
information in a database, but that part works and is not relevant to this
question so I am putting the filename right into the link to simplify the
code.

Try 1:
File to be retrevied = filename.pdf
Actual filename on server = files/12345~filename.pdf

<?php
// script name dl.php
$nfn=explode('~',$fn); // seperate actual filename from timestamp
(12345~)
$typ=explode('.',$fn); // get filetype from filename; I know
this will not work with files that have multiple periods in them, not
relevant to this question.
header('Content-type: application/'.$typ[1]);
header('Content-Disposition: attachment; filename="'.$nfn[1].'"');
readfile("files/".$fn);
?>

//Line to call for file from other webpage
<a href="dl.php?fn=12345~filename.pdf">Get file</a>

The above script works fine if the user clicks on the link to start the
download, but, if they should happen to drag the link to their desktop to
create a shortcut they get the file, only it is named dl.php. If they
rename the file to the proper extension it works fine but I don't want them
to have to rename the file.

Try 2:
If I use the following to redirect the page to dl.php it works from the link
or the shortcut, but then it leaves a blank orphaned browser window behind
in both cases.

<?
// script name=dl1.php
echo"
<script language=\"JavaScript\">
location.href=\"dl.php?fn=".$fn."\";
</script>";
?>

//Line to call for file from other script
<a href="dl1.php?fn=12345~filename.php" target=newwin>Get file</a>

Notice I added target=newwin in this link because without it the window with
the link on it goes blank due to the redirect.

Any help with this would be appreciated.