Comment 121 for bug 19250

+ // replace all control characters except LF, CR and tab with ?
+ label = label.replace(/[\x00-\x08]|[\x0B\x0C]|[\x0E-\x1F]/g, "?");

Could we replace them with U+FFFD instead?

+ label = label.replace("\\n", "\n");
+ label = label.replace("\\r", "\r");
+ label = label.replace("\\t", "\t");

I assume this doesn't actually convert literal "\n" characters in HTML
attributes into newlines. The following:

   <span title="yes\no">test</span>

...should render with the following tooltip:

   [ yes\no ]

...not:

   [ yes ]
   [ o ]

...right?