We are using HTML dumps based on https://github.com/wikimedia/htmldumper to test RESTBase changes in staging. While testing this, we encountered several invalid titles that contained the substring '&':
Those titles were returned by the allpages API end point. This could either be a broken encoding pass in the Action API, or a corruption in the page table.
Similar titles are apparently requested from the RESTBaseUpdateJob, which might point towards this being a bug in a common title escape method.
To find examples, search for the phrase "title-invalid-characters" in https://logstash.wikimedia.org/#/dashboard/elasticsearch/restbase.