Index: wp-includes/class-wp.php
===================================================================
--- wp-includes/class-wp.php	(revision 18627)
+++ wp-includes/class-wp.php	(working copy)
@@ -159,7 +159,7 @@
 			// front.  For path info requests, this leaves us with the requesting
 			// filename, if any.  For 404 requests, this leaves us with the
 			// requested permalink.
-			$req_uri = str_replace($pathinfo, '', $req_uri);
+			$req_uri = str_replace( $pathinfo, '', rawurldecode($req_uri) );
 			$req_uri = trim($req_uri, '/');
 			$req_uri = preg_replace("|^$home_path|", '', $req_uri);
 			$req_uri = trim($req_uri, '/');
@@ -199,7 +199,8 @@
 						$request_match = $req_uri . '/' . $request;
 
 					if ( preg_match("#^$match#", $request_match, $matches) ||
-						preg_match("#^$match#", urldecode($request_match), $matches) ) {
+						preg_match("#^$match#", urldecode($request_match), $matches) ||
+						preg_match("#^$match#", strtolower( rawurlencode($request_match) ), $matches) ) {
 
 						if ( $wp_rewrite->use_verbose_page_rules && preg_match( '/pagename=\$([^&\[]+)\[([0-9]+)\]/', $query, $varmatch ) ) {
 							// this is a verbose page match, lets check to be sure about it
Index: wp-includes/post.php
===================================================================
--- wp-includes/post.php	(revision 18627)
+++ wp-includes/post.php	(working copy)
@@ -3156,7 +3156,8 @@
 	$parts = array_map( 'sanitize_title', $parts );
 
 	$in_string = "'". implode( "','", $parts ) . "'";
-	$pages = $wpdb->get_results( $wpdb->prepare( "SELECT ID, post_name, post_parent FROM $wpdb->posts WHERE post_name IN ({$in_string}) AND (post_type = %s OR post_type = 'attachment')", $post_type ), OBJECT_K );
+	$post_type_sql = esc_sql( $post_type );
+	$pages = $wpdb->get_results( "SELECT ID, post_name, post_parent FROM $wpdb->posts WHERE post_name IN ({$in_string}) AND (post_type = '$post_type_sql' OR post_type = 'attachment')", OBJECT_K );
 
 	$revparts = array_reverse( $parts );