I know it works when typed into the address bar (although not in Konqueror, as it happens), but javascript: is a pseudo-URL scheme, not a real one, so it's invalid in Location headers.