The current core code assumes that if event listeners change any data, the data would be correctly escaped. However this requirement is not voiced in event description, parameters or its name.

http://area51.phpbb.com/phpBB/viewtopic.php?f=108&t=43835