We have several relationship types which have a URL whitelist. All other URLs are blocked. Sometimes, people manage to enter relationships they shouldn't be able to enter and up until now I'd never been able to figure out a way of doing it that seemed remotely plausible. Now I finally found one:
Steps to reproduce:
Open relate to URL page, e.g. for a release
Paste invalid URL, e.g. http://www.example.com/
Select a relationship type with a whitelist, e.g. "has cover art at"
Press enter
Expected result: Editor is prevented from entering the relationship
Actual result: The text "This URL is not allowed for the selected link type, or is incorrectly formatted." is shown, but the edit is submitted anyway.
I managed to reproduce it in Opera 10.10 and Safari 4.1.3 in OSX 10.4 and Opera Next 12.1 internal in OSX 10.7. I also managed to reproduce it in Firefox 7.0.1 in OSX 10.7 by clicking "Enter edit" rather than pressing enter.
Looks like urlChanged gets fired but it doesn't have an event.preventDefault() call so the submit goes through anyway.