{{& notallowed }}"></p>
  <p title="{{> notallowed }}"></p>
  <p title="{{ & notallowed }}"></p>
  <p title="{{ > notallowed }}"></p>

  <!-- Note, this is allowed by the validator, but it is critical that it
       be sanitized by the runtime. If the runtime allowed this, then after
       rendering (assuming #off was null) we would have:
      <a href="javascript:alert('foo')"></a>
   -->
  <a href="{{#off}}"></a>
    {{/off}}javascript:alert('foo'){{#off}}
  <a href="{{/off}"></a>

  <!-- Allowed by the 