It lets the following through:

<<script></script>script>...</script>
[download]

It's also a poor regexp in a more general sense since it it doesn't check if the > actually closes the tag of it's inside the quotes of an attribute value.