I don't have IE10 to test this with but I find it strange that you don't need to add
APEX_APPLICATION.g_unrecoverable_error := TRUE;
at the end of your code, to stop possible branches or further rendering.
That's the only thing in your code that I can see that can indicate an error. Can you create an example on apex.oracle.com if that does not help?
Your code looks fine (except what Joni mentioned)
When I have this type of code, it is always "On Load -- Before Header" on a dedicated page.
Also, I'd check your Firefox settings.
I had problems with viewing PDFs until I realized that FF was using its own PDF Viewer add-in instead of Adobe's.
It is possible the same thing is happening for that particular MIME Type.
Its trying to download an XLSX file... Strange thing is, if the code is moved to Oracle's hosted site, it works fine.. The hosting company I am with has this still under the http server setup as apposed to Glassfish with the Listener..
If you save the file to a drive, the file is saved okay, its just opening it directly via browser..