Unfortunately, internatialized paths use escape-encoded UT8.  I believe %E2%80%8B is a zero-width space, which is visible and meaningful in the case of some languages, though obviously not others.  Not sure what the fix here.

Note that if you include it in the domain name, the characters are removed entirely for just this reason.  They are not removed, and displayed as UTF8 characters instead when they're in the path (so this is not a security issue - displaying the wrong domain, or a confusing one, would be a serious security issue).

CCing some possible interested parties, to see if anything feels it's worth investing some effort here.  Similar characters are the the non-breaking space, and the zero-width joiner / non-joiner characters.