A filename can't contain the character / under Windows (or most other OSes), so you won't be able to stop that one getting converted. # is left alone by most browsers, the odd one out being IE.
Content-Disposition filenames are a bit limited. Non-ASCII characters aren't reliable in them and the proper escaping according to the RFC doesn't work. If you want to get Unicode characters into a default download filename—or certain other punctuation characters including # in IE—you have to URL-encode it and include that as a trailing part of the path, omitting the Content-Disposition filename. eg:
http://www.example.com/myscript.aspx/foo%23bar.xls
myscript.aspx:
response.AddHeader("Content-Disposition", "attachment");
(You still can't include / in a filename this way as web servers tend to block all URLs with %2F in. In any case, as above, you wouldn't be able to save it with a / in the filename anyway.)