From http://sourceforge.net/tracker/index.php?func=detail&aid=1166581&group_id=48726&atid=453976:

Since the coolmenu displayers render as javascript, any
menu item that contains single-quotes will break the
rendered code.

The self.status change in onmouseover events for
coolmenus4.js will break due to the single-quotes as well.

Example menu demonstrating behavior:

<Menu name="testMenu" title="Test">
<Item name="testJs" title="Alert box"
location="javascript:alert('testing 1 2 3')"/>
</Menu>

It is possible to work around this by escaping
single-quotes in the menu definition itself, but then
the menu item won't work if rendered normally, such as
with the Simple displayer.

The attached patch makes the following changes:
- CoolMenuDisplayer and CoolMenuDisplayer4 do a string
replacement for single quotes in the URL.
- The coolmenus4.js renders a blank status for
javascript: based URLs.

Patch at http://sourceforge.net/tracker/download.php?group_id=48726&atid=453976&file_id=126343&aid=1166581.