Hm, and in that case, it ignores the $jsSafe escapings ? wouldn't that count as a potential XSS vulnerability added here ? :-O