I just tried implementing this in conjunction with bootstrap-markdown, and one of the first things I tested was how JS is stripped from links. It appears that links are not sanitized for JS input. Take the following example:

[link](javascript:alert(alert))

This is being converted to:

<p><a href="javascript:alert(alert)">link</a></p>

Clicking on it shows a popup with the value of alert. This is obviously not a dangerous example, but a well-crafted string might be able to put site users in danger.