It's possible that you've still missed something, unless you're certain that .php is the only extension which your server executes (.php5 often works, and some servers will also run files with .cgi or .py extensions, among others). Blacklists are never fun.

The solution which occurs to me is (assuming you're on Apache) setting the .htaccess file in that directory to cause all files to be downloaded, regardless of their type. I haven't tested it, but I think this is the setting you'd need to make:

  ForceType application/octet-stream