Unless I'm reading things wrong, https://html.spec.whatwg.org/multipage/browsing-the-web.html#traverse-the-history step 14 recreates the state object.

Test:

1. Go to https://example.com/.
2. history.replaceState({foo: 'bar'}, '', '');.
3. window.tmp = history.state;.
4. Navigate to https://jakearchibald.com.
5. Press back.
6. window.tmp === history.state.

According to the spec, I'd expect the above to be false, but it's true in Firefox, Safari, and Chrome (with bfcache forced).

Browser behaviour seems reasonable to me, so I'll fix it in #6315.