This is the real problem in my opinion. The URL shown in the status bar should always match the URL which is opened after clicking on the link. Anything else is deception.
I don't know how you'd enforce it at the browser level because obviously there are tons of legit uses for modifying a link on click... but it should be enforced somehow.
