How to differentiate token replacement from array index
You can escape the left square bracket - [ using - %5B
and Right Square Bracket - ] using - %5D

So you should change your code in question to the following.

&lt;a href="/fillpdf?fid=33&amp;webform%5Bnid%5D=[nid]&amp;webform%5Bsid%5D=[sid]"&gt;Create a PDF&lt;/a&gt;