When an app is spawned using g_desktop_app_info_launch_uris_with_spawn it will expand the various token in the app's commandline with the URIs of the files to open. The expand_macro() function that is used for this advances the pointer to the URI list to show up to which entries it used.
To not loose the pointer to the list head a duplicate of the URI list was actually passed to expand_macro(). However, it's not necessary to create a copy of the URI list for that as expand_macro() will only change which element the pointer will point to.
This behaviour actually caused the duplicated list to be leaked as the the list pointer is NULL once all URIs are used up by expand_macro() and thus nothing was freed at the end of the function.
A corresponding Valgrind report from launching a GAppInfo in eog:
24 bytes in 1 blocks are definitely lost in loss record 6,780 of 33,258
at 0x483A809: malloc (vg_replace_malloc.c:307)
by 0x4B98978: g_malloc (gmem.c:102)
by 0x4BB0F41: g_slice_alloc (gslice.c:1024)
by 0x4B8DEFA: g_list_copy_deep (glist.c:755)
by 0x49D051D: g_desktop_app_info_launch_uris_with_spawn (gdesktopappinfo.c:2730)
by 0x49D3F04: g_desktop_app_info_launch_uris_internal (gdesktopappinfo.c:3017)
by 0x49D403E: g_desktop_app_info_launch_uris (gdesktopappinfo.c:3041)
by 0x49D403E: g_desktop_app_info_launch (gdesktopappinfo.c:3220)
by 0x4893C07: _eog_window_launch_appinfo_with_files (eog-window.c:1036)
by 0x489951D: app_chooser_dialog_response_cb (eog-window.c:1063)