Comment 1 for bug 1830661

With the "recover" option, you are asking the parser to ignore errors. Since you are not enabling the DTD usage, an undeclared entity is an error, and asking the parser to recover from it makes it keep that entity instead of raising that error.

Basically, you are explicitly asking for trouble, and shouldn't be surprised if you get it.