" in titles instead of "

I had this problem too, except I only noticed & as we hadn't uploaded any files with quotes in their names.

I fixed it by adding this line inside the _bulk_media_upload_generate_entity function:

$label = strtr($label, array("&" => "&"));

the end result looked like this

  entity_save($entity_type, $entity);

  // Replace tokens in title - this has to be done after entity_save.
  $label = token_replace($form_state['values']['title'], array($entity_type => $entity, 'file' => $file));

  //token_replace does some funky stuff with ampersands in file names, so fix that here:
  $label = strtr($label, array("&" => "&"));

  $entity->$label_field = $label;

  entity_save($entity_type, $entity);

Maaaybe this is a token module issue as the problem appeared after the call to token_replace but whatever.

Entity labels generally have their own sanitization logic, so the attached patch tells the token system not to sanitize the token values as the title is being generated.