When using the ScriptFreeTLV with allowRTExpressions set to false, the following: <c_rt:out value='<%= null %>'/> Isn't flagged as an error by the TLV.
*** This bug has been marked as a duplicate of 8522 ***