Thanks. I see the source of the problem and should be able to find the time to fix it fairly soon. No, it won't allow you to sneak unapproved attributes like onmouseover into HTML. And you don't have to create a user or approve nodes to exercise the bug. Just write, for example, <a href="/?node=login" title="and methion targetsomething">link</a>: link