I've worked with email security appliances that will visit the pdf url when detonating the attachment in a Sandbox. Dynamic analysis helps find 0day's ,sometimes the link leads to something worse,the link many times is a url shortner too