OK, now I get what was going on.

app/models/status_message.rb

@@ -43,7 +43,7 @@ class StatusMessage < Post
 
     escaped_message = opts[:plain_text] ? self.raw_message: ERB::Util.h(self.raw_message)
     mentioned_message = self.format_mentions(escaped_message, opts)
-    Diaspora::Taggable.format_tags(mentioned_message, opts)
+    Diaspora::Taggable.format_tags(mentioned_message, opts.merge(:no_escape => true))
   end
 
   def format_mentions(text, opts = {})

lib/diaspora/taggable.rb

@@ -38,6 +38,7 @@ module Diaspora
 
     def self.format_tags(text, opts={})
       return text if opts[:plain_text]
+      text = ERB::Util.h(text) unless opts[:no_escape]
       regex = /(^|\s)#(#{VALID_TAG_BODY})/
       form_message = text.gsub(regex) do |matched_string|
         "#{$~[1]}<a href=\"/tags/#{$~[2]}\" class=\"tag\">##{$~[2]}</a>"