This code behaves funny on Chrome (fiddle here):
try {
open('6:-=');
} catch(e) {}
First, despite the code being wrapped in a try-catch, an error is thrown:
Unable to open a window with invalid URL ‘%36:%04-=’.
Second, extraneous characters are inserted in the URL, namely %3 and %04.
Why doesn’t the try-catch intercept the error, and why does the URL have those extra characters?
Your fiddle contains a non-printable character with ASCII code 4 in the
6:-=string after the colon, which is URL-encoded as%04in the displayed error. In addition, the6:part of the provided URL is interpreted as an URL scheme, which cannot start with a digit, so apparently Chrome URL-quotes the 6 as%36as well, although such behavior is not prescribed by the RFC.