It seems to me that there is indeed a parsing difference between browser's and HtmlCleaner, I've tried setting such an HTML snippet as innerHTML in the browser and it worked, so the attribute value was parsed correctly. That's not nice and we should aim to get that fixed in HtmlCleaner as this could also be a problem in other situations.
This message was sent by Atlassian Jira (v9.3.0#930000-sha1:287aeb6)
If image attachments aren't displayed, see this article.
