Question's title attribute is not HTML encoded.
title: "Problems with HTML <marquee> tag"
title: "<Canvas> contents as data?"
I found it when on my app i saw a scrolling word due to the
<marquee> tag on the title :).
In a very remote way, this could be a problem, because afaik there are no constraints on question's title submission.
I could forge a question title (300 chars max) like:
What this script <script>evil_script_that_steal_your_stackexchange_webapp_cookies();</script> does?