Adcenter URL encryption

Adcenter, unlike Google and Yahoo, currently encrypts and obfuscates the target advertiser URL in its ad placements. So rather than including the target URL as a name-value pair in the internal redirect, they encrypt the whole kit-and-kaboodle. URLs end up looking like this:

[0.r.msn.com...]

Anyone have any idea how they're encrypting these values, and how one might get at the true destination URL of an Adcenter ad, short of crawling it?