Canonicalize() - Illegal hex characters in escape (%) pattern

No fix yet, but thorough analysis here: