XSS vulnerability in Seam Convesation management

When seam retrieve the conversationId from GET params, it does not do any checks.
In order to use the conversationId from Seam Remoting, Nuxeo dumps the conversationId in a JS script.
This is done via a simple h:outputText.
As stated in the documentation, h:outputText is supposed to escape any HTML content
=>http://java.sun.com/javaee/javaserverfaces/1.1_01/docs/tlddocs/h/outputText.html

Unfortunnaly, it does not seem to work when the <h:outputText> is inside a <script> tag.
Even forcing the escape does not change the result.

To reproduce, you can pass a conversionId like this : conversationId=0NXMAIN</sCrIpT><sCrIpT>alert('yo')</sCrIpT>