I ran into a situation today where on our new beta server, we have a custom web application with a subfolder named "Reports."  It always worked fine on my other servers, but on this server no files in that folder could be accessed from the site.  What's more, we'd receive a prompt for user credentials, despite the fact that the only authentication mechanism enabled on the entire site was anonymous.

It turns out it's SQL 2008 Reporting Service's fault.  In SQL 2005 and older, you would see a subfolder called "Reports" and "ReportServer" under the Default Website.  With SQL 2008, it seems SQL does it a little different.  You use its own configuration manager to assign what IP addresses and subfolders respond to Reporting server.  These paths then do NOT show up under IIS.  Since the default is all IP addresses, there was a name collision with our custom web application.

It's an easy fix.  Go into the Reporting Services configuration and make sure the two folders only respond to IPs not associated with your custom web application.

Still, not seeing the folders in the Default Website really threw me off.  Also, I'm not sure I like how SQL can just override all other site's folder in this manner.  Oh well.  I'm sure there's a good reason for it that I just can't see right now. :-)