I've been using the code that comes up when you click on "embed." Up until recently, that worked.
The point is bad code should just sit there and be bad code. Red X's and all that. It shouldn't just be summarily erased.
I suspect some WordPress anti-spam engine has gotten a bit too enthusiastic.