On your kPushButtonItemBoss there is an IID_IBEHAVIORLIST. In this case it points towards the kGoToURLBehaviorBoss.
The second step is sneaky, I consider it architecturally questionable (spell: b u g). Before this special case, I've only seen a similar approach with IScriptLabel …
The needed information is hidden within IID_IBEHAVIORDATA. You won't find it in IBehaviorData though, instead you have to use the extended interface of (in this case) IGoToURLBehaviorData. There are other behaviors that misbehave the same way, by using different interfaces on the same IID.
Cheers,
Dirk
