link_to_function() escapes double and single quotes via escape_once() into " and ' respectively.
update_element_function() escapes double and single quotes with backslashes via escape_javascript().
the problem is that escape_javascript() doesn't look for " or ' and they aren't properly escaped.
example code:
update_element_function('blahblah',array('content'=>link_to_function('blah2',"popUp('product_images/test.jpg', 900, 700, 'image')")));
example code's output:
$('blahblah').innerHTML = '<a href=\"#\" onclick=\"popUp('product_images/test.jpg', 900, 700, 'image'); return false;\">blah2</a>';
this problem arose from rev7900 when ENT_QUOTES was added to htmlspecialchars() in escape_once().
this probably applies to other functions that use escape_once() as well because escape_once() is used by _tag_options() which is used by content_tag().
