you are very right. I assumed the page title would be escaped, but creating a page named "<script>alert('foo');</script>" proved me wrong.