Two parts of the invalid title regex are effectively unreachable:
'|&#[0-9]+;' . '|&#x[0-9A-Fa-f]+;' .
This is because we do a fragment split (#) before illegal title characters are checked. So any character reference with a # in it will be split across the dbkey and fragment and fail to match the illegal character reference.
I believe this has been dead code ever since it was introduced in a3a2744d033c41a0456d495f6a0fb5e8165224bf.
Co-discovered with @Erutuon as part of our mwtitle-in-Rust project.