If you create a group with an HTML entity in it, say A&B, the group name is displayed on Special:Userrights as A&B. This is because the groupCheckboxes function in SpecialUserrights.php calls htmlspecialchars on the group name and then calls Xml::checkLabel which does another htmlspecialchars.
I haven't tested this on 1.16.5 but a quick glance at the code shows that the problem still exists in trunk.
Version: 1.20.x
Severity: normal