Yes,
document.location
can be faked.