TinyMCE 4.2.8 has known XSS bugs. publish/editor.js has the same toolbar and writes the same HTML. The textarea still posts the story.
tim