Issue #2264041 by pwolanin, dawehner, cilefen, chx: Fixed Add a test to ensure title callbacks are not vulnerable to XSS.