Well it seems that Firefox 2.0.0.14 has provided the most interesting results with my protocol fuzzer.
Char: 56320, link: jav�ascript: Char: 56321, link: jav�ascript: Char: 56322, link: jav�ascript: Char: 56323, link: jav�ascript: Char: 56324, link: jav�ascript: Char: 56325, link: jav�ascript: ,, ,, ,, ,,
All the way to:-
char: 57343, link: jav�ascript:
and hex entities but with a semi-colon:-
From: Char: 56320, link: javí°€ascript: To: Char: 57343, link: javí¿¿ascript:
It means code like this works in Firefox 2.0.0.14:-
<a href="jav�ascript:al�ert(1)">test</a>
More oddities were found but nothing as interesting as the above.
The ever changing XML file can be found here which stores the vectors by platform and browser versions:-
Update…Opera strangeness too…
Char:2048,Link:javascriptࠀ: Char:2304,Link:javascriptऀ: Char:3328,Link:javascriptഀ: Char:3840,Link:javascriptༀ: Char:4096,Link:javascriptက: Char:4256,Link:javascriptႠ: Char:4352,Link:javascriptᄀ: Char:4608,Link:javascriptሀ: Char:4864,Link:javascriptጀ: Plus nbsp is allowed here:- Char:160,Link: javascript:
There are more, higher ones too 