http://www.serpentine.com/blog/2010/11/29/a-small-matter-of-illegal-characters/

1
Now imagine someone sends the string '<scr\xd800ipt src="evil.js"></script>'.