Thats because we do this
if ($Globals['allowhtml'] == "yes" ) $desc = un_htmlspecialchars( $desc );
else $desc = convert_markups( un_htmlspecialchars($desc) );
Basically convert_markups will allow normal html to just be shown correctly but not parsed. Try entering a table and an image tag and you will see what I mean. Your using an iframe so thats not touched which is why it works as is. Convert_markups makes img tags and the normal nasty ones safe
as well as convert bbcode