As a RSS Bandit user you know we are hosting a IE Control. So we have to consider all the security vulnerability related to Internet Explorer. Don Park pointed to Zap the Dingbat, that provides a exploit to test Url spoofing. We use our own Url toolbar, so my first idea was: we should be aware of this. But the used control is not under our control, so I really had to test it out. Here is the result:

You see: it displays the full address not cutted after the magic character... Doh!