XSS through conflict resolution still reproducible

Steps to reproduce:

1. Login as Admin
2. Edit a page, add some text, but do not save
3. Login as an user without script right in another browser or in Incognito mode
4. Edit the same document (force the edit on warning), add <script>alert('XSS')</script> in the content and delete some existing text to cause a conflict
5. Save the page
6. As Admin, save the page as well
7. On the conflict window, select "Fix each conflict individually"

Expected result:

The conflict window is displayed, but without an alert.

Actual result:

An alert with content "XSS" is displayed.