Oh, if you knew how I dislike this piece of code :)

IMO one of the more or less acceptable solutions would be to extend Template with method similar to ```interpolate``` that returns DocumentFragment instead of string. Then we don't need to care about sanitizing and this intermediate code.

On a more general note I think we should avoid such code at all or at least make it generic and safe to be able to place it to shared because:
* purpose of this method is too common for other apps, so that shared Utils\HtmlHelper can provide this; 
* anything that implies security risk (even if it's "private") should be in shared so that more people audit and test this, and apps that use it won't miss any important updates.

I also still don't have a good idea on dealing with it in this particular case :(  I'll add "sanitazing" comment you've suggested for now.