I installed your updated download.php yesterday to enable non-standard character files to be downloaded. This went fine, but unfortunately I also peeked at the code, and discovered something.
Imagine that two users are downloading the same album simultaneously. According to the script, the MP3 files are copied to the /tmp directory, tared, and then deleted.
This means that as soon as the files are combined for one user, they're deleted from the /tmp folder, possibly before the other user's archive has been finished, causing the second user to lose files.
It's not a problem that can be expected to occur often, but it's easy to fix: simply create a folder in the /tmp directory for each user, and create the archive for download in the user's folder.
Of course, if the same user downloads the same files twice, you'll face the same problem, but possibly with a lower probability. This can also be fixed easily by creating a temporary folder for each download session.