As of this moment, I'm running the current git HEAD (b961235b197647d6649ef3d48d7cc2cecafe3d47) in order to get proper URI handling under LXDE. (Not that it's detected as such. See bug #36905)
With this version, ampersands in the the query string of an HTTP URL are converted to %U, breaking the URL in the process.
Here's an example which will demonstrate the issue when run:
I've manually reversed the order of the parameters because ordinary YouTube URLs work (Apparently, if you pass something too long for the "v" parameter, YouTube will truncate it and try again) and the original case I encountered this bug in was clicking the link in my Bugzilla confirmation e-mail inside Thunderbird.
This is due to the following line in xdg-open:
arguments_exec="`echo $arguments | sed -e 's*%[fFuU]*"'"$1"'"*g'`"
In sed parlance the "&" is special, from the sed man page: "The replacement may contain the special character & to refer to that portion of the pattern space which matched"
So any & in the URL will be replaced with the arguments.
The simple fix for this is to escape & in the input string, though a more robust fix is probably in order (not using PCRE perhaps) the following patch fixes the problem.
argone=`echo $1|sed 's/&/\\\\&/g'`
arguments_exec="`echo $arguments | sed -e 's*%[fFuU]*"'"$argone"'"*g'`"
> (not using PCRE perhaps)