When using the ScriptFreeTLV with allowRTExpressions set to false, the following: <c_rt:out value='<%= null %>'/> Isn't flagged as an error by the TLV.
*** Bug 8523 has been marked as a duplicate of this bug. ***