In template_preprocess_media_youtube_default_external(), the video url is ran through check_plain(). This causes ampersands to be encoded twice, so the object tag ends up looking like this:

<object type="application/x-shockwave-flash" height="90" width="220" data="http://www.youtube.com/v/VIDEO_ID&amp;amp;rel=0&amp;amp;enablejsapi=1&amp;amp;playerapiid=ytplayer&amp;amp;fs=1" id="media-youtube-default-external-object-1">

I don't see this causing any problems, but still I wonder: Is this by design, or is it a bug?