Profiler labels don't escape HTML

[zzzzBov]

From source, labels are set with:

<td class="profiler-label"><%= $value.name %></td>

I can't tell if this is meant as a "feature" or whether it's an unintentional bug.

If it's a bug I assume it should be something along the lines of:

<td class="profiler-label"><%= MiniProfiler.safeHtml($value.name) %></td>