Sanitize file name

Another bunch…
There is actually an easier way to do this that avoids any manual HTML escaping:

```
element.innerHTML = "";
element.appendChild(element.ownerDocument.createTextNode(runtime.tr('Loading') + url) + '...');
```

That would be my preference here :bowtie: