Most people don't realize it, but URL encoding is actually different depending on which character set is used at the time. Characters can be corrupted if a string is URL encoded using one character set and decoded using a different character set.
Take for example the Ä character. Using the default character encoding for Windows in the US (cp1252) it's encoded as %C4, however using UTF-8 it's encoded as %C3%86. If you encode it with UTF-8 and decode it with cp1252 you actually wind up with two characters instead of one.