Unfortunately, this is due to a breaking change introduced by ASP.NET 4.0. A workaround right now would be to ask ASP.NET to revert back to the older behavior by adding the following to your configuration:
<httpRuntime requestValidationMode="2.0" />
For a more complete discussion, see issue #217 on the ELMAH project site.