Checking some code I had the need to check in deep the component tree, so I added an ui:debug to the page. Then I realized that the fix done long time ago over
MYFACES-3154 does not work well.
The problem cannot be seen easily, because it requires the addition of a query param in getActionUrl(...) . This happens when CODI is used, because a windowId is appended to the viewId. This script is surrounded by a CDATA section, so escape the & is not necessary.
I did some tests using UTF-8 and ISO-8859-1 encoding and the fix work well for both cases.