Users of the icon script services shouldn't have any expectations what kind of HTML it outputs. Icon themes can also be provided by extensions and could thus contain arbitrary HTML. Instead, they need to properly escape the result before inserting it into a JavaScript file.