If you try to access a script that isn't in the file system (i.e.
doesn't actually exist - 404), IIS returns this:

--- snip ---
CGI Error

The specified CGI application misbehaved by not returning a complete set
of HTTP headers. The headers it did
return are:
--- snip ---

does this exist in PHP 4.0.4?

update from Phill Driscoll:

This is certainly how 4.0.4 and indeed 4.0.4pl1RC1 and all its
predecessors work. I'm not sure I'd call it a bug though.
There are settings in IIS for each script map file extension, where you
can tell IIS to check if the script exists first (and if the user has
sufficient permission to access the file). If the script isn't there,
IIS sends a 404
response. If the script is there, but the user does not have permission,
then an 'authentication required' is sent.

thus this is an IIS configuration issue; closing.