After I found the entry in the pcap file and went to decode the form encoding to re-post it, I find this, the cause of the UTF-8 bug:
Notice the %10 in there? That's not a valid UTF-8 byte, at least in the strict interpretation, which expat follows. Why the hell did Safari send it? Did I type something weird? Still.