Now that `ambModuleId` is back to being an an argument to `ExternalInterface.call`, I think we *do* need this escaping. The initial XSS problem was that Flash wasn't escaping `\` when converting Flash types to JS types, so we need to do it for them.