Fixed xss vuln in playlist. drupal_render does not return safe output for title.