Fix this line of yours:
tmp += "window.open(AccessPrivilleges.aspx?EmpNumber=" & EmpNumber & "','width=400,height=320')"
Right now, here the page name is not in quotes and thus when it will be executed your code would try to find a variable named "AccessPrivilleges.aspx?EmpNumber=" which is incorrect. make sure the syntax used is correct and the whole javaScript tag formed is correct.
Put a break point, use VS debugger and VS watch to see what is formed as 'tmp' before you assign it to be used in RegisterClientScriptBlock. The script tag formed should be such that if you copy paste it in a normal page or in designer it works.
Try!