Cannot call replaceState from within a popState handler

[AlexGalays]

This works just fine on a html5 browser but is not supported when the shim is active.

I believe the bug is located in changeState(), where lastURL ends up getting nulled.