As the OP points out this shouldn't be an issue on production systems as display_errors shouldn't be turned on.

From the PHP docs [1]:

    This is a feature to support your development and should never be used on production systems (e.g. systems connected to the internet).

Of course how many of the notoriously lazy/incompetent PHP developers we have all had to deal with in our lives have RTFM.

So could PHP perhaps HTML encode error messages? Would this break any error message use cases? For example are there times when error messages appear when they wouldn't be interpreted as HTML encoded? CLI? Browsers loading different text mime types?

[1] http://www.php.net/manual/en/errorfunc.configuration.php#ini...