Okay. Now I understand. That is going to be difficult, I'm afraid.
You are going to have to query the DB, and assign the product's category's clean URL to an array. I think I can put you on the right track. On the product page, it looks like the $location array is being built near line 292, with this snippet of code:
Code:
// Get category location
if (
$cat > 0
&& $current_category = func_get_category_data($cat)
) {
if (is_array($current_category['category_location'])) {
foreach ($current_category['category_location'] as $k => $v) {
$location[] = $v;
}
}
}
Recursively search your files for that function "func_get_category_data", hopefully you can understand it's operation enough to add the Clean URL to the array, rather than the home.php?cat=123 that is currently being passed.