Changing form destinations strips query and fragment

My site has a form which would otherwise go to http://example.com/somepath?destination=node%2F212345 (i.e., that's the $form[#action] variable).

Secure pages alters the form destination to switch it to https — but it also strips the query string from that destination. The resulting $form[#action] variable is https://example.com/somepath

It would also strip the "fragment" (what's after a # sign). So http://example.com/somepath#section1 would be replaced by https://example.com/somepath.