To be honest, I was hoping that Lycidas, one of only two people schooled in syntax that we have here on the forum, could offer a generative analysis.
My suspicion is that when we say Who did Tom say saw him?, there is complementiser deletion going on (the omission of that). Consider the declarative structure:
Tom said (that) Bob saw him.
Even if we omit the that in the sentence above, it's still 'there' as a null complementiser. At the moment, I can't see why one can't analyse the question Who did Tom say saw him? in the same way. The fact that the complementiser is typically omitted in natural speech doesn't necessarily mean it's ungrammatical not to delete it.
I may be hopelessly wrong about all this, but I'm not yet convinced I am. I would be grateful if anyone could point out what I've got wrong.