fixes doc.title override expressInstall's flashVars

in showExpressInstall, because of doc.title escape is not eough, doc.title can override key-value pair in par.flashvars, MMredirectURL and MMplayerType.