Creating a user with '&' in the name succeeds, but then all attempts to navigate to it fail

We have had some people create users with '&' in the username (creating users that represent groups... which we would prefer that they didnt do).

The user creation succeeds - but then any attempt to view details on that user results in the following error

"The user london c does not exist. Please try another"

Where "london c" is meant to be the username "london c&r"