Found well testing a new solution to T119158. I don't entirely understand the mechanism behind this yeThe regex in LanguageConverter::autoConvert(), which matches parts of the HTML document not to convert, can hit pcre.backtrack_limit on some input (default in php is 100,000 but it is configurable). The regex fails to match anything after the point it hits the backtrack limit, but appears that a regex somewhere is hitting pcre.backtrack_limit (default in php is 100,000 buso language conversion substitutions are done on the entire document, instead of just the part that it is configurable)supposed to be done.
To exploit: Create a rule followed by at slightly more than pcre.backtrack_limit characters (without any newlines). After that, the substitution rule will be applied everywhere, including within tags.
E.g. Create a page with the following form:
```
-{H|big=>sr-el:script}- foo <0X repeated at least 100000 times>
<big>alert(1)</big>
```
And then view it in the sr-el variant
(For testing, its easier if you set pcre.backtrack_limit to a smaller number than default)