Setting location.href with relative path occasionally results in incorrect path

Question

Quick Summary

I am working on an issue that shows up in production that I cannot replicate. As a result I am debugging this based on tracing the code and looking in the server logs. The point of failure is there is a request for one servlet with the arguments for another servlet. This a a transient situation, after 2-3 tries the issue goes away.

Detailed Explanation

There are three basic URLs in play here the first is of the shape

http://example.com/Apps/x9/HowdyServlet?argument=foo

And the second is

http://example.com/Apps/x9/OtherServlet?argument=bar

And the third is

http://example.com/Apps/servlet/MainServlet?thing=1

Then we have a div that is part of a navigation bar on the second page that looks like this:

<div id="FrobberNav" 
 title="Navigate to Frobber" 
 class="top-navigation-button " 
 onmouseover="x9.topNav.mouseover(this);" 
 onmouseout="x9.topNav.mouseout(this);" 
 onclick="location.href='../servlet/MainServlet?thing=1'"
 style="float:right">
<a id="FrobberNavLink" 
   name="FrobberNavLink" 
   href="#" 
   onclick="return false;" 
   title="Navigate to Frobber">Frobber</a>
</div>

The little bit of associated JavaScript for the mouseover is

x9.topNav.mouseover = function(element) {
  var mouseoverClasses = element.className + " top-navigation-button-hover";

  // update element classes
  element.className = mouseoverClasses;
};

x9.topNav.mouseout = function (element) {
  removeClass(element, 'top-navigation-button-hover');
};

The error is that occasionally when someone clicks on that div they don't go to URL #3 but rather are sent to

http://example.com/Apps/x9/HowdyServlet?thing=1

The important thing to notice here is that this is an "impossible" URL since the search parameters and servlet have been mixed up.

This is a Java application that for the most part is rendering pages via RichFaces driven from Spring Web Flow. We don't have much in the way of fancy JavaScript that would be rewriting that page behind my back.

Here is Where I Gnash My Teeth

I cannot reproduce this bug on my local or in our DEV or UAT environments. I have searched the production logs and I see this happening a handful of times every few days. Production is running on iPlanet servers that serve static content and then pass application requests back to some Weblogic servers. I can see the broken requests in the iplanet logs so I know that it is not some URL rewriting going wrong on the incoming path.

I have user/tester testimony that this is the button they were trying to press when things went wrong. There are also no other places where this particular link is generated but the Java code that I can identify.

It almost feels like the location.href value from the first page is somehow lingering and being used to construct the new link. Are there any race conditions like that?

My tester can confirm that that happens under IE and others say that it has happened under both Chrome and Firefox.