Input filters does not work when creating new private message

as well as replying on the message.

Here is background:

If you use standard Full HTML filter then it is possible to run javascript code on you page to steal user cookie, e.g.

<script type="text/javascript">
alert(document.cookie);
</script>

This is sample code to show cookies, but you can write a code to pass cookies of every user, who loads the page, and therefore you take control over his account.

To prevent that I installed Safe HTML module. It strips potentially dangerous tags from you input. After installation you just have to check this inut format filter. And it works fine exept with Private Messages.

Can you fix that?
I think it is critically dangerous.