referrer_charset is a lie. It's really the user's default_charset.

net/http/http_content_disposition.cc

Index: net/http/http_content_disposition.cc
===================================================================
--- net/http/http_content_disposition.cc	(revision 119865)
+++ net/http/http_content_disposition.cc	(working copy)
@@ -12,9 +12,9 @@
 namespace net {
 
 HttpContentDisposition::HttpContentDisposition(
-    const std::string& header, const std::string& referrer_charset)
+    const std::string& header, const std::string& default_charset)
   : type_(INLINE) {
-  Parse(header, referrer_charset);
+  Parse(header, default_charset);
 }
 
 HttpContentDisposition::~HttpContentDisposition() {
@@ -61,7 +61,7 @@
 //  ext-token           = <the characters in token, followed by "*">
 //
 void HttpContentDisposition::Parse(const std::string& header,
-                                   const std::string& referrer_charset) {
+                                   const std::string& default_charset) {
   DCHECK(type_ == INLINE);
   DCHECK(filename_.empty());
 
@@ -77,11 +77,11 @@
     if (filename.empty() && LowerCaseEqualsASCII(iter.name_begin(),
                                                  iter.name_end(),
                                                  "filename")) {
-      DecodeFilenameValue(iter.value(), referrer_charset, &filename);
+      DecodeFilenameValue(iter.value(), default_charset, &filename);
     } else if (filename.empty() && LowerCaseEqualsASCII(iter.name_begin(),
                                                         iter.name_end(),
                                                         "name")) {
-      DecodeFilenameValue(iter.value(), referrer_charset, &filename);
+      DecodeFilenameValue(iter.value(), default_charset, &filename);
     } else if (ext_filename.empty() && LowerCaseEqualsASCII(iter.name_begin(),
                                                             iter.name_end(),
                                                             "filename*")) {