[userbinator]

However, it's a valid URL

I doubt "\0javascript" is a valid URI scheme since they must begin with a letter, and any code that uses 0-terminated strings would just see it as an empty string. The fact that the \0 somehow seems to be ignored completely is most disturbing.

Edit: I double-checked the spec ( http://www.w3.org/TR/html5/browsers.html#dom-open ) just to make sure there's no weird "skip nulls" behaviour, and there isn't.

[GICodeWarrior]

This is one of those cases where browsers are different from the spec. (BTW, the spec you are looking for is here https://url.spec.whatwg.org/)

It really depends on the browser. Here are a few test cases to consider. http://jsfiddle.net/8e525ne9/

Leading nulls used to work in common browsers. Most recent browsers don't support it. However, most do continue to support fun things like newlines and tabs in the middle of URL schemes.