The placeholder ends with a decimal URL index. The substitution is an incremental pass from zero index, so when the placeholder is substituted back to URL the replacing code matches incomplete index and we got a messed URLs.
E.g. we replace placeholder #K#T#P1 and it actually mess up #K#T#P10 and #K#T#P11
Add a end marker to the placeholder scheme to never mess URL.
An alternative solution is to reverse the backward substitutions but meh. :)
BUG: 384968
FIXED-IN: 18.12.3