Every now and then I catch myself not doing this but by and large I always type out URLs for ads/emailed links by hand. It takes out a lot of the attack surface for me, and it looks like in this case it would have worked.