Add test case to show &attributes does not escape