OK, since someone resurrected this thread, here's an update. I figured out how to paypal him the money and sent it less than 24 hours after the auction closed. You won't see it if you do a search of the auctions I bid on, because it was one where the bidders' identities were hidden. (Apparently there's been a lot of spam sent to the people who are bidding on the autographed Harry Potter widgets.) About a week later, I saw he was re-auctioning the same autographed cast picture. I e-mailed him and he said he'd overlooked my payment and relisted it. He pulled the auction, sent it to me, and I left positive feedback. Today I got an e-mail from someone telling me she bought four autographs from him and they were all forgeries. I sure hope she's wrong.
But you're right--sending payment wasn't that bad, and it got here really fast. For now I'm going to stop bidding on autographed widgets.