Previously, used a regexp to find and convert named entities in the content. Now use a more efficient algorithm. Similar tweak for converting NCRs before checking whether text is valid utf-8.
Another XSS hole: the contents of <nowiki>...</nowiki> was not being sanitized.