And from the HTML::Entities documentation:

If called in void context the arguments are decoded in-place.

So the solution is to not call in void context:

$filename = decode_entities($filename);
[download]

As a side note, if you are migrating or securing an old script, you should take a read through perltaint. It'll help you protect yourself from classic exploits.