I saw what looked like a UAF of this URL in a RequestServer crash, and it seems reasonable to make a copy here since we end up passing them to Core::deferred_invoke().