fix bug 863527 by updating test instead of parsing untrusted input
Merge pull request #9326 from pauljt/bug863527_v2

Bug 863527 -- Safer html injection in app error, r=alive