Ultimately I want to do both. Test all BBCodes when they're created, and test BBCodes that are not marked as unsafe when they're loaded.