I doubt "\0javascript" is a valid URI scheme since they must begin with a letter, and any code that uses 0-terminated strings would just see it as an empty string. The fact that the \0 somehow seems to be ignored completely is most disturbing.

Edit: I double-checked the spec ( http://www.w3.org/TR/html5/browsers.html#dom-open ) just to make sure there's no weird "skip nulls" behaviour, and there isn't.