Parser should filter (% style="background:url('javascript:badscript') %) because some browsers will execute such script.

I see no reason why a script should be used for generating a background (which only works in some browsers) and I think we should be filtering such script.
Some browsers (IE and some versions of Safari) will run the javascript.
Will still run if newlines are inserted:

(% style="background:url('java
script:badscript') %)

also runs.

I consider it low priority until there is a mechanism for limiting which users have permission to invoke the html macro.