Here's the strange part: at some point in my testing, it stopped blocking anything at all. All of the things that it used to flag as "forbidden content" were allowed through. I could use any tag I wanted including the obvious <script>. What would cause this?
One guess is that that the routine is throwing an exception and that the exception is handled by simply returning as if everything is okay, but I don't know why it would do that every time. Would there be a reason for it to maintain state? If it does, I could see it getting so screwed up that it can't run without throwing an exception.
Is there something else it could be doing? I don't have source code to check this and I've never run into a similar error while coding.