Steve should be able to shed more light on this than me but I can help a little.
First up a ‘pdf’ file is most definitely an ‘other file’ type and NOT a media file. So yes ‘pdf’ and ‘PDF’ should just about cover it.
Now – as to that message then first I have to say that is not an SP message or – as far as I know – a plUploader message. Looks to me like it is a server message and a quick (very quick) google suggests the culprit is mod_security on your server. That is something you will need to talk to your host about.
As to opening a PDF – the standard, default procedure would be to make a PDF file available for downloading – not opening.