PWN-1565 was caused by unreachable code in handlebars.

The handlebars currently used is very old: per commit 6b8152d - Update to latest handlebars.js (a07dae5)

a07dae5 of handlebars has bug where unescaping in handlebars, does not reset itself correctly so that subsequent expressions that should be escaped, remain unescaped.

This was tested both manually and by getting a07dae5 of handlebars and adding the following 2 test cases in test/handlebars.js
 shouldCompileTo("{{{awesome}}} {{awesome}}", {awesome: "&\"\\<>"}, '&\"\\<> &amp;\"\\\\&lt;&gt;',
        "subsequent expression was NOT escaped");

 shouldCompileTo("{{awesome}} {{{awesome}}}", {awesome: "&\"\\<>"}, '&amp;\"\\\\&lt;&gt; &\"\\<>',
        "expressions with 3 handlebars aren't escaped");
To run the tests, simply open test/index.html in a browser: they should all pass.

Note: technically the correct test case should be like these:
 shouldCompileTo("{{{awesome}}} {{awesome}}", {awesome: "&\"\\<>"}, '&"\\<> &amp;&quot;\\&lt;&gt;',
        "expressions should still be escaped after an unescaped expression");

 shouldCompileTo("{{awesome}} {{{awesome}}}", {awesome: "&\"\\<>"}, '&amp;&quot;\\&lt;&gt; &\"\\<>',
        "expressions should be escaped (easy)");
These 2 tests, when added to the current version of handlebars (5659db4), pass.
However a07dae5 is so old that its escaping has other inaccuracies.

To correctly fix these issues, may be tricky.  The current version uses better libraries and techniques, for example:
c79c761 - Add support for escaping mustaches (2 years, 1 month ago) <Yehuda Katz>|
Add tests for escaping fix