Version 1.2.0 introduces a major XSS vulnerability

Version 1.1.0: no problem - http://jsfiddle.net/hxao6bc5/
Version 1.2.0: problem - http://jsfiddle.net/ptsL5md0/

Not sure of which commit introduces it, but here's the diff