Well, as it turns out Rasmus Lerdorfs filter made apache segfault, so I've disabled it again. XSS indeed!

On a lighter note, this work of art was created last night during the OSDC dinner: http://www.youtube.com/watch?v=NfVL_4uRLSo