I noticed this after using the AjaxFormLoop AddRowLink on a page which has an onActivate and onPassivate resulting in the addition of a "t:ac" to the url. Debugging showed me that the t:ac is already present on instantiation of the LinkImpl. When calling toAbsoluteUri the parameters are added in a way where they will always start with a "?". Obvisouly resulting in an invalid URL with two ?'s
I'm building a failing test at this stage and will provide a patch once resolved.