Index: wp-admin/includes/media.php
===================================================================
--- wp-admin/includes/media.php	(revision 18607)
+++ wp-admin/includes/media.php	(working copy)
@@ -636,7 +636,7 @@
 		if ( !empty($href) && !strpos($href, '://') )
 			$href = "http://$href";
 
-		$title = esc_attr($_POST['insertonly']['title']);
+		$title = esc_attr(stripslashes($_POST['insertonly']['title']));
 		if ( empty($title) )
             $title = esc_attr( basename($href) );
 
@@ -695,7 +695,7 @@
 		if ( !empty($href) && !strpos($href, '://') )
 			$href = "http://$href";
 
-		$title = esc_attr($_POST['insertonly']['title']);
+		$title = esc_attr(stripslashes($_POST['insertonly']['title']));
         if ( empty($title) )
             $title = esc_attr( basename($href) );
 
@@ -754,12 +754,15 @@
 		if ( !empty($href) && !strpos($href, '://') )
 			$href = "http://$href";
 
-		$title = esc_attr($_POST['insertonly']['title']);
+		$title = esc_attr(stripslashes($_POST['insertonly']['title']));
 		if ( empty($title) )
 			$title = basename($href);
+
 		if ( !empty($title) && !empty($href) )
 			$html = "<a href='" . esc_url($href) . "' >$title</a>";
+
 		$html = apply_filters('file_send_to_editor_url', $html, esc_url_raw($href), $title);
+
 		return media_send_to_editor($html);
 	}