htmlSafe Not Safe

controllers.application.js

import Ember from 'ember';

export default Ember.Controller.extend({
  appName: 'Ember Twiddle',
  htmlToRender: '',
  actions: {
    loadArbitraryScriptTag() {
      alert('action fired');
      this.set('htmlToRender', Ember.String.htmlSafe('<svg witdth="300" height="300" onclick="alert(\'XSS\');">'));
    }
  }
});

templates.application.hbs

<h1>Welcome to {{appName}}</h1>
<br>
<br>
{{htmlToRender}}
<br>
<br>
<button {{action "loadArbitraryScriptTag"}}>Button</button>
<br>
<br>

{{outlet}}
<br>
<br>

twiddle.json

{
  "version": "0.13.0",
  "EmberENV": {
    "FEATURES": {}
  },
  "options": {
    "use_pods": false,
    "enable-testing": false
  },
  "dependencies": {
    "jquery": "https://cdnjs.cloudflare.com/ajax/libs/jquery/1.11.3/jquery.js",
    "ember": "2.16.2",
    "ember-template-compiler": "2.16.2",
    "ember-testing": "2.16.2"
  },
  "addons": {
    "ember-data": "2.16.3"
  }
}