If a feed has a weird or relative url, it's not made absolute in the feed list > little settings icon > "see website" link. I could put "myevil/url/delete/feed" in my custom feed...