--- a/mailnews/base/src/nsMessenger.cpp
+++ b/mailnews/base/src/nsMessenger.cpp
@@ -662,17 +662,16 @@ nsresult nsMessenger::SaveAttachment(nsI
                                      const nsACString &aContentType,
                                      void *closure,
                                      nsIUrlListener *aListener)
 {
   nsCOMPtr<nsIMsgMessageService> messageService;
   nsSaveAllAttachmentsState *saveState= (nsSaveAllAttachmentsState*) closure;
   nsCOMPtr<nsIMsgMessageFetchPartService> fetchService;
   nsAutoCString urlString;
-  nsCOMPtr<nsIURI> URL;
   nsAutoCString fullMessageUri(aMessageUri);
 
   // This instance will be held onto by the listeners, and will be released once
   // the transfer has been completed.
   RefPtr<nsSaveMsgListener> saveListener(new nsSaveMsgListener(aFile, this, aListener));
 
   saveListener->m_contentType = aContentType;
   if (saveState)
@@ -699,17 +698,18 @@ nsresult nsMessenger::SaveAttachment(nsI
     urlString.Cut(typeIndex, sizeof("?type=application/x-message-display") - 1);
     // we also need to replace the next '&' with '?'
     int32_t firstPartIndex = urlString.FindChar('&');
     if (firstPartIndex != kNotFound)
       urlString.SetCharAt('?', firstPartIndex);
   }
 
   MsgReplaceSubstring(urlString, "/;section", "?section");
-  nsresult rv = CreateStartupUrl(urlString.get(), getter_AddRefs(URL));
+  nsCOMPtr<nsIURI> URL;
+  nsresult rv = NS_NewURI(getter_AddRefs(URL), urlString);
 
   if (NS_SUCCEEDED(rv))
   {
     rv = GetMessageServiceFromURI(aMessageUri, getter_AddRefs(messageService));
     if (NS_SUCCEEDED(rv))
     {
       fetchService = do_QueryInterface(messageService);
       // if the message service has a fetch part service then we know we can fetch mime parts...
@@ -1017,17 +1017,16 @@ nsresult nsMessenger::AdjustFileIfNameTo
 NS_IMETHODIMP
 nsMessenger::SaveAs(const nsACString& aURI, bool aAsFile,
                     nsIMsgIdentity *aIdentity, const nsAString& aMsgFilename,
                     bool aBypassFilePicker)
 {
   nsCOMPtr<nsIMsgMessageService> messageService;
   nsCOMPtr<nsIUrlListener> urlListener;
   RefPtr<nsSaveMsgListener> saveListener;
-  nsCOMPtr<nsIURI> url;
   nsCOMPtr<nsIStreamListener> convertedListener;
   int32_t saveAsFileType = EML_FILE_TYPE;
 
   nsresult rv = GetMessageServiceFromURI(aURI, getter_AddRefs(messageService));
   if (NS_FAILED(rv))
     goto done;
 
   if (aAsFile)
@@ -1100,18 +1099,19 @@ nsMessenger::SaveAs(const nsACString& aU
       }
       else
       {
         saveListener->m_outputFormat = nsSaveMsgListener::eHTML;
         saveListener->m_doCharsetConversion = false;
         urlString.AppendLiteral("?header=saveas");
       }
 
-      rv = CreateStartupUrl(urlString.get(), getter_AddRefs(url));
-      NS_ASSERTION(NS_SUCCEEDED(rv), "CreateStartupUrl failed");
+      nsCOMPtr<nsIURI> url;
+      rv = NS_NewURI(getter_AddRefs(url), urlString);
+      NS_ASSERTION(NS_SUCCEEDED(rv), "NS_NewURI failed");
       if (NS_FAILED(rv))
         goto done;
 
       nsCOMPtr<nsIPrincipal> nullPrincipal =
         do_CreateInstance("@mozilla.org/nullprincipal;1", &rv);
       NS_ASSERTION(NS_SUCCEEDED(rv), "CreateInstance of nullprincipal failed");
       if (NS_FAILED(rv))
         goto done;

--- a/mailnews/base/util/nsMsgUtils.cpp
+++ b/mailnews/base/util/nsMsgUtils.cpp
@@ -110,20 +110,16 @@ NS_MSG_BASE void MsgLogToConsole4(const 
     return;
   console->LogMessage(scriptError);
   return;
 }
 
 using namespace mozilla;
 using namespace mozilla::net;
 
-static NS_DEFINE_CID(kImapUrlCID, NS_IMAPURL_CID);
-static NS_DEFINE_CID(kCMailboxUrl, NS_MAILBOXURL_CID);
-static NS_DEFINE_CID(kCNntpUrlCID, NS_NNTPURL_CID);
-
 #define ILLEGAL_FOLDER_CHARS ";#"
 #define ILLEGAL_FOLDER_CHARS_AS_FIRST_LETTER "."
 #define ILLEGAL_FOLDER_CHARS_AS_LAST_LETTER  ".~ "
 
 nsresult GetMessageServiceContractIDForURI(const char *uri, nsCString &contractID)
 {
   nsresult rv = NS_OK;
   //Find protocol
@@ -163,61 +159,16 @@ nsresult GetMsgDBHdrFromURI(const char *
   nsCOMPtr <nsIMsgMessageService> msgMessageService;
   nsresult rv = GetMessageServiceFromURI(nsDependentCString(uri), getter_AddRefs(msgMessageService));
   NS_ENSURE_SUCCESS(rv,rv);
   if (!msgMessageService) return NS_ERROR_FAILURE;
 
   return msgMessageService->MessageURIToMsgHdr(uri, msgHdr);
 }
 
-nsresult CreateStartupUrl(const char *uri, nsIURI** aUrl)
-{
-  nsresult rv = NS_ERROR_NULL_POINTER;
-  if (!uri || !*uri || !aUrl) return rv;
-  *aUrl = nullptr;
-
-  // XXX fix this, so that base doesn't depend on imap, local or news.
-  // we can't do NS_NewURI(uri, aUrl), because these are imap-message://, mailbox-message://, news-message:// uris.
-  // I think we should do something like GetMessageServiceFromURI() to get the service, and then have the service create the
-  // appropriate nsI*Url, and then QI to nsIURI, and return it.
-  // see bug #110689
-  nsCOMPtr<nsIMsgMailNewsUrl> newUri;
-  if (PL_strncasecmp(uri, "imap", 4) == 0)
-  {
-    nsCOMPtr<nsIImapUrl> imapUrl = do_CreateInstance(kImapUrlCID, &rv);
-
-    if (NS_SUCCEEDED(rv) && imapUrl)
-      rv = imapUrl->QueryInterface(NS_GET_IID(nsIMsgMailNewsUrl), getter_AddRefs(newUri));
-
-    // XXX Consider: NS_MutateURI(new nsImapUrl::Mutator()).SetSpec(nsDependentCString(uri)).Finalize(newUri);
-  }
-  else if (PL_strncasecmp(uri, "mailbox", 7) == 0)
-  {
-    nsCOMPtr<nsIMailboxUrl> mailboxUrl = do_CreateInstance(kCMailboxUrl, &rv);
-    if (NS_SUCCEEDED(rv) && mailboxUrl)
-      rv = mailboxUrl->QueryInterface(NS_GET_IID(nsIMsgMailNewsUrl), getter_AddRefs(newUri));
-  }
-  else if (PL_strncasecmp(uri, "news", 4) == 0)
-  {
-    nsCOMPtr<nsINntpUrl> nntpUrl = do_CreateInstance(kCNntpUrlCID, &rv);
-    if (NS_SUCCEEDED(rv) && nntpUrl)
-      rv = nntpUrl->QueryInterface(NS_GET_IID(nsIMsgMailNewsUrl), getter_AddRefs(newUri));
-  }
-
-  if (newUri) {
-    // SetSpecInternal must not fail, or else the URL won't have a base URL and we'll crash later.
-    rv = newUri->SetSpecInternal(nsDependentCString(uri));
-    NS_ENSURE_SUCCESS(rv, rv);
-
-    newUri.forget(aUrl);
-  }
-  return rv;
-}
-
-
 // Where should this live? It's a utility used to convert a string priority,
 //  e.g., "High, Low, Normal" to an enum.
 // Perhaps we should have an interface that groups together all these
 //  utilities...
 nsresult NS_MsgGetPriorityFromString(
            const char * const priority,
            nsMsgPriorityValue & outPriority)
 {

--- a/mailnews/base/util/nsMsgUtils.h
+++ b/mailnews/base/util/nsMsgUtils.h
@@ -44,18 +44,16 @@ class nsIProtocolProxyCallback;
 //These are utility functions that can used throughout the mailnews code
 
 NS_MSG_BASE nsresult GetMessageServiceContractIDForURI(const char *uri, nsCString &contractID);
 
 NS_MSG_BASE nsresult GetMessageServiceFromURI(const nsACString& uri, nsIMsgMessageService **aMessageService);
 
 NS_MSG_BASE nsresult GetMsgDBHdrFromURI(const char *uri, nsIMsgDBHdr **msgHdr);
 
-NS_MSG_BASE nsresult CreateStartupUrl(const char *uri, nsIURI** aUrl);
-
 NS_MSG_BASE nsresult NS_MsgGetPriorityFromString(
                        const char * const priority,
                        nsMsgPriorityValue & outPriority);
 
 NS_MSG_BASE nsresult NS_MsgGetPriorityValueString(
                        const nsMsgPriorityValue p,
                        nsACString & outValueString);
 

--- a/mailnews/local/src/nsMailboxService.cpp
+++ b/mailnews/local/src/nsMailboxService.cpp
@@ -349,18 +349,18 @@ NS_IMETHODIMP nsMailboxService::OpenAtta
                                                nsIUrlListener *aUrlListener)
 {
   nsCOMPtr <nsIURI> URL;
   nsAutoCString urlString(aUrl);
   urlString += "&type=";
   urlString += aContentType;
   urlString += "&filename=";
   urlString += aFileName;
-  CreateStartupUrl(urlString.get(), getter_AddRefs(URL));
-  nsresult rv;
+  nsresult rv = NS_NewURI(getter_AddRefs(URL), urlString);
+  NS_ENSURE_SUCCESS(rv, rv);
 
   // try to run the url in the docshell...
   nsCOMPtr<nsIDocShell> docShell(do_QueryInterface(aDisplayConsumer, &rv));
   // if we were given a docShell, run the url in the docshell..otherwise just run it normally.
   if (NS_SUCCEEDED(rv) && docShell)
   {
     nsCOMPtr<nsIDocShellLoadInfo> loadInfo;
     // DIRTY LITTLE HACK --> since we are opening an attachment we want the docshell to