symfony/symfony — pull request #7090 by Tobion (2013-02-15 21:27:01+00:00)
Title: [HttpKernel] hinclude fragment renderer must escape URIs properly to reurn valid html

Bug fix: yes

Since rendering of hinclude fragments returns html/xml and is marked as safe. So it's not auto-escaped of course. But that means it must properly escape it's input (the URI) when outputting in html context.
Btw, this does not need to be done for esi because esi tags are processed in middleware which do not go to the client/browser.