I discovered wfAppendQuery urlencodes passed query only if it is passed as an array (because wfArrayToCgi calls urlencode), but leaves it intact if it is passed as a text. That makes $title->getLocalUrl('page=User talk:Foo') throw an URL that breaks when passed to wikitext's [url description] syntax.

I'm not sure what's the best way to fix. Should we change wfAppendQuery to call urlencode when string is passed (which would require having an inverse function to wfArrayToCgi), or should we remove urlencode from wfArrayToCgi, and change all callers to urlencode themselves?