possible Xss on php 5.4+

I am reporting https://www.drupal.org/requirements to moderators because:

in documentation stated that

Drupal 7: PHP 5.2.5 or higher (5.3 recommended).

Fresh installation of Drupal 7 on PHP 5.4, 5.5 allow xss

Steps to reproduce the issue:

install Drupal with php 5.4, 5.5
add <img> tag to allowed tags for Filtered HTML text format
create Basic Page with Body in Filtered HTML text format and content <img src=" &#14; javascript:alert(0)">
Save Page
View page content - it is not filtered for javascript.

Please clarify documentation about versions of PHP for Drupal 7
I did not reported this in Drupal Core issues because in PHP 5.3 content is filtered.