I think there should be no problem, as your script can simply attach itself to tars output. There come some problems with that, too, as your download cannot be resumed, but I guess you can live with that. Here is some code how I would try it - I've never done this myself, so a look into perlipc could maybe help you a bit more.

  $blocksize = 4096;

  open( BACKUP, "tar cz $directory |" ) or die "can't fork tar: $!\n";
  binmode BACKUP; # just to be on the safe side

  do {  
    $read = read( BACKUP, $data, $blocksize ) or die "can't read: $!\n
+";
    if ($read) {
      print $data;
    };
  } while $read;

  close BACKUP;
[download]

As with your second problem, the "wrong" filename, you can either instruct your webserver to treat your script as a directory and everything following the script name as a parameter to your script (look in the Apache documentation, as it's been a long time since I did this, I guess under SCRIPTEXEC), and issue a redirect from your script (if called without parameters) to an URL with the parameters :

  http://invalid.com/cgi-bin/backup.cgi
  -> http://invalid.com/cgi-bin/backup.cgi/backup.tar.gz
[download]