Core: HTML escaping with createTextNode where appropriate