T250338#6170464 is (partially) an example. The method consists of:
public function commaList( array $list ) {
return implode(
wfMessage( 'comma-separator' )->inLanguage( $this )->escaped(),
$list
);
}taint-check correctly infers that the return value of the function is escaped (because it contains an escaped part), hence trying to further escape the result will trigger an issue. However, $list may very well be tainted, hence it makes sense to escape the return value sometimes. In order for the double escape to be noticeable, one would have to use raw html in the 'comma-separator' message, which is unlikely.
I honestly don't have a nice solution for this. It's unclear whether the retval of commaList is intended for use in HTML or not. Perhaps there should be two different methods using different escaping levels. Alternatively, we might just annotate commaList as returning a non-escaped value, assuming that no-one will ever use raw HTML in the comma-separator message.