[XSS Vulnerability] Using a replace function for sanitizing the string

@masatokinugawa was so kind to email us about a security vulnerability.

Here's what he said.

```
PoC: 
http://zeroclipboard.org/javascripts/zc/ZeroClipboard_1.3.1.swf?jsModuleId=%ED%A0%80\"))}catch(e){alert(1)}// 

This XSS is brought by Flash's bug. It seems that Flash Player can't 
treat the high surrogate character (U+D800 - U+DBFF) properly. 

You can see this buggy behavior from the following URL: 
http://vulnerabledoma.in/flash_surrogate_test.swf?q=%ED%A0%80\abc 
(The source code is here: http://vulnerabledoma.in/flash_surrogate_test.as ) 

"q" parameter is set to "[U+D800]\abc". [U+D800] ( %ED%A0%80 ) is high 
surrogate. 
The displayed results is: 

loaderInfo.parameters["q"] returns "[U+FFFD]abc" 
loaderInfo.parameters["q"].split("\").join("\\") returns "[U+FFFD]\abc" 
```

This pull implements his suggestion of using a `replace(/\\/g,"\\\\")` instead of `split("\").join("\\")`

@JamesMGreene @ptoomey3 @jnewland @mastahyeti