I also use the official reference first-hand ;o)
From the example given on the Wiki page of the Rewrite module you quoted,
they replace 'last' by 'break' when rewrite rules put inside a location
Isn't it a problem to put 'last' flags inside the location block? What is
the 10-cycles-then-500-error referring to?
The 500 error is cause by the rewrite: it rewrites /download/ (clean
url) to /download/ (actual file). If it use last flag, the /download/
location block will be searched again (and in fact it may return 403
instead of 500 if the rewritten url doesn't match the rewrite rule
anymore - it'll return 500 only on certain cases).
The one you want is for it to be handled by different location block
(\.php$) - hence last flag.