Topic title is text, so HTML entities in it simply appear.

But when you view a standalone topic (from a permalink, or when you open a topic action action in a new tab, or presumably when you choose a topic action with no-JavaScript), Flow puts the un-escaped topic title in the <h1 class="firstHeading"> and in the <title> tag.

Compare the URL above with https://test.wikipedia.org/wiki/Talk:Sandbox?workflow=rxpkw658tqvrvnsd

Version: master
Severity: major
URL: http://ee-flow.wmflabs.org/wiki/Talk:Sandbox?workflow=rvjdx5ai0quoj0qo