Its been pointed out in IRC that A.Changing microb to work around a bug in Google is a bad idea and B.The fact that an unescaped & sign can possibly appear in a Google results page is a potential security risk.

So the patch on this bug should be ignored (although people can run local copies with that patch if they want Google to work in the short term) and Maxdamantus on IRC has submitted (or will submit) a security report to Google describing the details and hopefully Google can sort it out.