Better solutions to deal with this are necessary. We realize that all these special situations and the lack of a single bulletproof set of steps for encoding user data, wherever it may occur on the page, makes the task of fixing this problem quite challenging in some cases. We wish we had a better answer, and are working on filling in the fuzzy areas. By design, this function does not strip attributes from the tags. This means it is often possible to include things such as JavaScript event attributes.
Some clients accept such attributes on tags that are otherwise benign.
Unfortunately, this is yet again likely not sufficient in all situations.