You read it right. Its not Locker Service that may break your code, but Summer 17. If you have legacy Visualforce page, which needs to navigate to Lightning experience and URLFOR is used directly, then chances of getting below error are very high.
In above screenshot, I got MALFORMED_ID : malformed Id error in one of my Visualforce, where I needed to navigate to new Account record.
Steps to reproduce error
Create below Visualforce in Summer 17, where Lightning experience is enabled.
Next step is to override New button of Account by above Visualforce page.
After this setup, if we try to create New Account, below page will appear.
In above code, if we click first two URL, we will get an error. However, third URL will work.
Key take away in this post is that, we need to use sforce.one object, which will be available by default in Lightning experience.
Problem in above code and sforce.one API:
Above code will not be redirected properly on cancel button. so we can say even sforce.one is not full proof. In that scenario, we can use below snippet. Notice how URL is used here
var simpleURL = '/one/one.app#/sObject/Account/new?nooverride=1&retURL=/001' ; sforce.one.navigateToURL(encodeURI(simpleURL));
Its too early to party 🙁 . Above code will work only in Summer 17 but not in previous release.
I was not able to find solution which will work in Summer 17 as well as in Spring 17. Please drop a comment if you know the answer else we have to live with this code, as anyways all instances would be moved to Summer 17 in few weeks.
Below Video shows the issue and its fix discussed in this post.