I've taken a look at the issue and the changes to the DNN 4.7 core code. The function "NavigateURL()" eventually calls the FriendlyURL converter function. In the past it called the URLEncode() function but in DNN 4.7 it was changed to call URLPathEncode(). Unfortunately, MS's documentation on the functions tells you little about what the function really does. What I found thru testing is that the URLEncode() function converts a " " to "+" while URLPathEncode() converts " " to "%20". And when there is a %20 in the middle of the URL, IIS appears to get messed up and no longer be able to determine that it should load Default.aspx.
What is interesting, is that from what I can see with the code, any code that calls NavigateURL() and passes in a querystring parameter that is blank will get this error. Amazing no other modules have had any problems yet...
On my versions of the Gallery module I changed the code so that when the path is blank (root level images) that is puts in "/" for the path. While I didn't test it, I would have to guess that if you turned off friendlyurl's (in the host settings menu) that should also get it to work.
www.Jegers.com