This is related to jQuery 1.9's [change](https://jquery.com/upgrade-guide/1.9/#jquery-htmlstring-versus-jquery-selectorstring) in how HTML is recognized by the $() function.
* mwUiTooltipShow (modules/engine/misc/mw-ui.enhance.js) looks like it allows passing arbitrary HTML as content, which would be affected by this; this should also be documented.
* plaintextSnippet (flow-handlebars.js) should use $.parseHTML for safety when contentFormta is 'html'.
* FlowBoardComponentApiEventsMixin.UI.events.apiHandlers.moderateTopic and FlowBoardComponentApiEventsMixin.UI.events.apiHandlers.moderatePost use HTML directly from processTemplate, making them affected by this issue (also, apparently processTemplateGetFragment should be used instead of this in general, and we may want to make processTemplate private).
* 'html' is a misleading variable name for the return value of processTemplateGetFragment (e.g. in flow-board-api-events.js) (not an actual bug, but related and confusing)