Reading about XSS and its countermeasures from http://www.xssed.com/xssinfo#Avoiding_XSS_vulnerabilities , it says (in the 2nd last paragraph of the link) that:
[…] support for Unicode character sets by browsers could leave an application open to XSS attacks if the HTML quoting algorithms only look for known-bad characters.
So, how does one exploit a page which looks only for known-bad unicode characters? An example would be highly appreciated.