You are correct. But the theoretical attack from "https://accounts.google.com/reallyuglyurl https://accounts.google.com/reallyuglyurl to "https://accounts.goo

You are correct. But the theoretical attack from "https://accounts.google.com/reallyuglyurl https://accounts.google.com/reallyuglyurl to "https://accounts.google.com/ServiceLogin https://accounts.google.com/ServiceLogin remains on the same origin. So while what you say is true, it is not applicable for the example.