1) open src.html (allegated) in firefox. Both with a text editor or with firefox's source viewer, you can see the source HTML: <!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN"> <html> <head> <meta http-equiv="content-type" content="text/html; charset=ISO-8859-1"> <title></title> </head> <body> <form action=""> <input type="button" OnClick="parent.frame1.location='source.html?a=1&b=2'"> </form> </body> </html> 2) in Firefox, do File-> Save as, and name it dst.html (allegated, too). Open it with a text viewer. It's been changed, and it's no more valid HTML (& has been substituted with &, among the other things): <!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN"> <html><head> <meta http-equiv="content-type" content="text/html; charset=ISO-8859-1"><title></title></head> <body> <form action=""> <input onclick="parent.frame1.location='source.html?a=1&b=2'" type="button"> </form> </body></html>
Created attachment 41859 [details] src.html
Created attachment 41860 [details] dst.html
Confirmed, it does the same thing on mozilla-firefox-1.0 Please file this upstream at http://bugzilla.mozilla.org