Well, this is where I am lost a bit - documentation only says "replacement string", and from my understanding this includes possible expansion of variables (like everywhere else), and it doesn't mention (or I couldn't find, at least) that rewrite target is normalized URI (or that variables could be processed differently). Probably, this is the only case where expansion is processed differently from literal values.

On the other hand, if rewrite target expects a normalized URI, then mangling with arguments there should not be possible at all, as there could be mixture of normalized and escaped values in single string.