this is not HTML, its SMIL - should we still escape?