Comment 8 for bug 1057832

This thesis (section 3.3.2) explains one of the problems with arbitrary redirections: it allows an attacker to get other people to perform one-click exploits on their behalf, or distributed denial of service attacks.

http://itsec.rwth-aachen.de/theses/url

Another problem is that avatar URLs can be used to obscure links in phishing emails. Either on their own or as part of a redirection chain.