There's a bug in lib/MT/Sanitize.pm.

See here for details.