Index: wp-includes/kses.php
===================================================================
--- wp-includes/kses.php	(revision 8387)
+++ wp-includes/kses.php	(working copy)
@@ -850,13 +850,23 @@
 
 	$string2 = preg_split('/:|:|:/i', $string, 2);
 	if ( isset($string2[1]) && !preg_match('%/\?%', $string2[0]) )
-		$string = wp_kses_bad_protocol_once2($string2[0]) . trim($string2[1]);
+		$string = wp_kses_bad_protocol_once2($string2[0], $allowed_protocols) . trim($string2[1]);
 	else
-		$string = preg_replace_callback('/^((&[^;]*;|[\sA-Za-z0-9])*)'.'(:|:|&#[Xx]3[Aa];)\s*/', 'wp_kses_bad_protocol_once2', $string);
+		$string = preg_replace_callback('/^((&[^;]*;|[\sA-Za-z0-9])*)'.'(:|:|&#[Xx]3[Aa];)\s*/', 'call_wp_kses_bad_protocol_once2', $string);
 
 	return $string;
 }
 
+// Helper function used instead of create_function() for preg_replace_callback() in wp_kses_bad_protocol_once()
+function call_wp_kses_bad_protocol_once2( $matches ) {
+	global $_kses_allowed_protocols;
+
+	if ( ! isset($matches[1]) || empty($matches[1]) )
+		return '';
+
+	return wp_kses_bad_protocol_once2($matches[1], $_kses_allowed_protocols);
+}
+
 /**
  * wp_kses_bad_protocol_once2() - Callback for wp_kses_bad_protocol_once() regular expression.
  *
@@ -865,21 +875,11 @@
  *
  * @since 1.0.0
  *
- * @param mixed $matches string or preg_replace_callback() matches array to check for bad protocols
+ * @param string $string Content to check for bad protocols
+ * @param array $allowed_protocols Allowed protocols
  * @return string Sanitized content
  */
-function wp_kses_bad_protocol_once2($matches) {
-	global $_kses_allowed_protocols;
-
-	if ( is_array($matches) ) {
-		if ( ! isset($matches[1]) || empty($matches[1]) )
-			return '';
-
-		$string = $matches[1];
-	} else {
-		$string = $matches;
-	}
-
+function wp_kses_bad_protocol_once2($string, $allowed_protocols) {
 	$string2 = wp_kses_decode_entities($string);
 	$string2 = preg_replace('/\s/', '', $string2);
 	$string2 = wp_kses_no_null($string2);
@@ -888,7 +888,7 @@
 	$string2 = strtolower($string2);
 
 	$allowed = false;
-	foreach ( (array) $_kses_allowed_protocols as $one_protocol)
+	foreach ($allowed_protocols as $one_protocol)
 		if (strtolower($one_protocol) == $string2) {
 			$allowed = true;
 			break;
@@ -920,12 +920,20 @@
 	# Change back the allowed entities in our entity whitelist
 
 	$string = preg_replace('/&([A-Za-z][A-Za-z0-9]{0,19});/', '&\\1;', $string);
-	$string = preg_replace_callback('/&#0*([0-9]{1,5});/', 'wp_kses_normalize_entities2', $string);
-	$string = preg_replace_callback('/&#([Xx])0*(([0-9A-Fa-f]{2}){1,2});/', 'wp_kses_normalize_entities3', $string);
+	$string = preg_replace_callback('/&#0*([0-9]{1,5});/', 'call_wp_kses_normalize_entities2', $string);
+	$string = preg_replace_callback('/&#([Xx])0*(([0-9A-Fa-f]{2}){1,2});/', 'call_wp_kses_normalize_entities3', $string);
 
 	return $string;
 }
 
+// Helper function used instead of create_function() for preg_replace_callback() in wp_kses_normalize_entities() 
+function call_wp_kses_normalize_entities2($matches) {
+	if ( ! isset($matches[1]) || empty($matches[1]) )
+		return '';
+
+	return wp_kses_normalize_entities2($matches[1]);
+}
+
 /**
  * wp_kses_normalize_entities2() - Callback for wp_kses_normalize_entities() regular expression
  *
@@ -934,15 +942,19 @@
  *
  * @since 1.0.0
  *
- * @param array $matches preg_replace_callback() matches array
+ * @param int $i Number encoded entity
  * @return string Correctly encoded entity
  */
-function wp_kses_normalize_entities2($matches) {
-	if ( ! isset($matches[1]) || empty($matches[1]) )
+function wp_kses_normalize_entities2($i) {
+	return ( (!valid_unicode($i)) || ($i > 65535) ? "&#$i;" : "&#$i;");
+}
+
+// Helper function used instead of create_function() for preg_replace_callback() in wp_kses_normalize_entities() 
+function call_wp_kses_normalize_entities3($matches) {
+	if ( ! isset($matches[2]) || empty($matches[2]) )
 		return '';
 
-	$i = $matches[1];
-	return ( ( ! valid_unicode($i) ) || ($i > 65535) ? "&#$i;" : "&#$i;" );
+	return wp_kses_normalize_entities3($matches[2]);
 }
 
 /**
@@ -951,15 +963,11 @@
  * This function helps wp_kses_normalize_entities() to only accept valid Unicode numeric entities
  * in hex form.
  *
- * @param array $matches preg_replace_callback() matches array
+ * @param string $h Hex string of encoded entity
  * @return string Correctly encoded entity
  */
-function wp_kses_normalize_entities3($matches) {
-	if ( ! isset($matches[2]) || empty($matches[2]) )
-		return '';
-
-	$hexchars = $matches[2];
-	return ( ( ! valid_unicode(hexdec($hexchars)) ) ? "&#x$hexchars;" : "&#x$hexchars;" );
+function wp_kses_normalize_entities3($hexchars) {
+	return ( (!valid_unicode(hexdec($hexchars))) ? "&#x$hexchars;" : "&#x$hexchars;");
 }
 
 /**