Going to assume that Steve is not awake yet, and will fix the source code when he gets up and sees comments.
It does work on SQL 2005, only tested on 32 bit. Only tested 2008 on 64 bit.
It does not require Excel to be installed on the server.
Performance testing on this is sort of useles. There is nothing to compare it to.
There is a security risk with this, no doubt about that. But, if the DBA has good control over what goes on the server in the CLR procedures, I don't think the risk in unreasonable. Now, there are DBAs that do not know C#/.NET at all and would be very uncomfortable with this, and understandably so. I've gone trough a wholescale conversion of my thinking in the last year, from being a firm "no CLR until I know more," to now seeing the light and that it is useful in many circumstances.
As far as the path goes. The code that will be in the source, can also very easily be added directly to a C# application to export to Excel from that. That was actually the original venue for this functionality, when I saw that in Nick's code I wanted to know if we could easily expose that functionality in SQL.