Object creations are not always validated. Most probably validation is lacking when objects are created inside a function. As an example, consider revision 138 of YellowGrass:

https://svn.strategoxt.org/websvn/issolar/trunk/?rev=138

The validation on tags is not enforced upon tag creation. For example, in the addTag template (in tag/tag.app), the addTag action can create a tag with any name. Try tagging an issue with the name “(#$*&$%(#@#” and editing this tag afterwards.

Submitted by Sander Vermolen on 8 February 2011 at 10:41