In lib/weblib.php around line 1011, inside function choose_from_menu_nested(), there is the following:

$output .= ' <optgroup label="'. s(format_string($section)) .'">'."\n";

The double escaping of the $section string is causing optgroup labels to display HTML codes such as "&"

To reproduce the issue, simply put this code in a test page:

<?php
require_once 'config.php';

$options['One & two'][1] = 'One';
$options['One & two'][2] = 'Two';
print choose_from_menu_nested($options, 'number');
?>