Give the gift of Drupal. All merchandise is 50% off through 2016.
_htmlpurifier_load() unconditionally calls variable_set() to set the current installed version of htmlpurifier. This is called by hook_filter_info(), and due to, hook_filter_info() is called on every request. Drupal 7 has locking for variable_initialize(), which means when the variable cache is cleared on every request, it's equivalent to the site only being able to serve one page per second (or more, depending on how long the lock is held for). Attached patch checks the current version to ensure we only set it if it's changed.