But that allows trivial [JavaScript injection](http://help.adobe.com/en_US/FlashPlatform/reference/actionscript/3/flash/external/ExternalInterface.html#call()) from the Flash object, doesn't it?

How about something completely different: If we make the changes in #203 conditional upon an installation-specific setting `adhocracy.allow_user_html` (we can even default that to true for a transition period), legacy users can continue to use HTML, while other installations can simply default to markdown. Does that work for you?