Leading slashes in the second urljoin argument will return exactly that argument, breaking FileSystemStorage.url behavior if called with a parameter with leading slashes. Also added test cases for null bytes and None. Thanks to Markus for help and review.