1. Change UA to be iPhone. 2. Load google.com. 3. Click on GMail and log in. 4. Load apple.com 5. Click on back Instead of GMail page, you got a log in page The reason is in _loadURL in WebFrame.mm, it uses the originalURLString() of the childItem. The original request was POST and redirect to a GET, so formData of childItem is NULL. When it is used in history navigation, the POST request was issued as GET. That is why it got the wrong page.
Using WebKit-SVN-r38064.dmg on Mac OS X 10.5.5 with UA set to Mobile Safari 1.1.3 - iPhone I can not reproduce the behaviour described.