I just realized we were talking about !alert in the context of lslua, where lslua.message_box is more or less the same. But anything able to inject linefeed chars could do it too; the embedded newlines to !alert require there be a body and title (two arguments).

But you're also asking for ls core to handle escape codes.
We also want escape codes for $, ', and "