Apparently OK in practice

These work in iceweasel (Debian's unbranded firefox build), Chromium, w3m, lynx, links and MSIE:

• Unescaped [
• Unescaped ]
• Unescaped @
• Unescaped !
• Unescaped $
• Unescaped &
• Unescaped '
• Unescaped (
• Unescaped )
• Unescaped *
• Unescaped +
• Unescaped ,
• Unescaped ;
• Unescaped =

Don't work well everywhere

Colon :

• Unescaped : with scheme before it - if this works, the browser's probably doing it wrong
• Unescaped : works in many browsers
• Unescaped @ and : also works in many browsers
• Unescaped : with scheme before it, but also an explicit scheme
• Unescaped : with full path
• Unescaped : with leading ./

Percent %

Apache seems to reject these, and MSIE doesn't even allow clicking on them. They may work for file: URLs (they do in iceweasel at least):

• Unescaped % not followed by hex
• Unescaped % followed by one hex