Allowing any old executable outside the webroot to be run from an SSI is a security risk, so IIRC Apache's default SSI configuration doesn't allow it, but if you configure it right this should work:

<!--#exec cmd="/some/path/to/command" -->
[download]

Where the "/some/path/to/command" is run via the system shell, much like the 1-arg version of system() in perl.