Paul McMillan (Django security guru and all-around smart guy) and I just spent quite a while discussing this issue, here's what we came up with:
First, this is an issue which, if at all possible should be solved at the language level. This is because it's often hard to tell where data comes from a user, and where it's safe.
We're also in agreement that this should be solved at the language level, and shouldn't be configurable. It will be far to easy to deploy in an enviroment that's insecure if you get it wrong.