cymric

After a bit of searching I found my own answer: yes, ampersands and the like are processed before the shortcode-handlers are called. A simple preg_replace() to transform them back before I did further processing was the answer. (However, be careful if you then want to print a string containing such an unescaped ampersand; your document will otherwise not be valid (X)HTML!)

The cause was determined by some WordPress wizard to be related to an obscure runtime configuration setting in the PHP interpreter, specifically the one called ‘pcre.backtrack_limit’. Increasing this 10-fold from the deafult value of 1e5 by a line like

ini_set('pcre.backtrack_limit', 1000000);

in the initialisation code of the plugin made the bug disappear.