This is why redirect links should limit themselves to relative URLs, or limit it to a whitelisted set of domains.

(Can anyone think of downsides to limiting yourself to relative URLs or a whitelist of domains?)

It is very interesting that Youtube has this vulnerability. Almost every time I implement something like this, I double check the domain name. (This is really easy in PHP)