title: innerHTML for character reference in attribute value is not preserved as escaped secuence. Any way to workaround?
body: <p>I put such code to Firefox:</p>
  
  <pre><code>&lt;div id="my"&gt;
      &lt;div title="&amp;lt;b&amp;gt; title &amp;lt;/b&amp;gt;"&gt;&amp;lt;b&amp;gt; text &amp;lt;/b&amp;gt;&lt;/div&gt;
  &lt;/div&gt;
  </code></pre>
  
  <p>After evaluation of:</p>
  
  <pre><code>document.getElementById("my").innerHTML
  </code></pre>
  
  <p>I got:</p>
  
  <pre><code>"&lt;div title="&lt;b&gt; title &lt;/b&gt;"&gt;&amp;lt;b&amp;gt; text &amp;lt;/b&amp;gt;&lt;/div&gt;"
  </code></pre>
  
  <p>As you can see title attribute is damaged... Is this a bug?</p>
  
  <p>Link to playground: <a href="http://jsfiddle.net/uGXQP/" rel="nofollow">http://jsfiddle.net/uGXQP/</a></p>
  
  <p><strong>UPDATE</strong> I run tests under Firefox and Opera - it reproduced. On Chrome it work as expected.</p>
  
  <p><strong>UPDATE 2</strong> I found this issue then work with <a href="http://code.google.com/p/canvg/" rel="nofollow">http://code.google.com/p/canvg/</a> project. It have main routine which require SVG as string as input argument. Natural way to do so is to use <strong>innerHTML</strong>...</p>
  
  <p>So this library parse DOM as string and can't handle properly <strong>&lt;></strong> chars it stream in attribute value...</p>