Using the same key for two distinct algorithms incurs the risk of interactions. An extreme example is when you use both AES/CBC for encryption and CBC-MAC as MAC algorithm: if you use the same key for both, then it is pretty obvious that the MAC can be trivially worked around. For AES/CBC + HMAC, the gut feeling of most cryptographers is that the two algorithms are sufficiently "different" from each other that these interactions do not occur, but putting a precise, mathematical definition under that term looks challenging.
Basically, this is untrodden territory, so don't do it. Deriving an encryption key and a MAC key from a given master key, using a Key Derivation Function, is the cautious and safe method: it ensures that no deadly interaction may occur. Since you have some HMAC code, use HKDF for such derivation: it is easy to implement, and has received the blessing of many cryptographers.
Alternatively, you may want to ditch both CBC and HMAC, and instead use an authenticated encryption mode which combines encryption and MAC with the same key. These are specialized modes where interactions have been thoroughly analysed, and all nasty details worked out. GCM and EAX are usable without legal hassle, and are fine; GCM is also a NIST standard and is beginning to be widely used (e.g. as part of SSL/TLS).