location.href (and related url accessors) access the url at FrameLoader::url(). Sadly and inexplicably, this url is not always in sync with Document::URL() and probably should be. If https://bugs.webkit.org/show_bug.cgi?id=34555 is resolved, this bug will probably just go away. But I'm filing it to make sure the issue is not forgotten. I'll add a test case showing how it manifests in the real world in the morning, as I'm in a hurry right now :)
This is closely related to https://bugs.webkit.org/show_bug.cgi?id=34555