As indicated in http://dev.w3.org/html5/spec/syntax.html#attributes-0 :

Attribute values are a mixture of text and character references, except with the additional restriction that the text cannot contain an ambiguous ampersand.

The reference does not mention that:

attribute values can contain text and character references, with additional restrictions depending on whether they are unquoted attribute values, single-quoted attribute values, or double-quoted attribute values. Also, the HTML elements section of this reference describes further restrictions on the allowed values of particular attributes, and attributes must have values that conform to those restrictions.

http://dev.w3.org/html5/markup/syntax.html#syntax-attributes


Note that the definition of ambiguous ampersands differs from the specification's. The specification says:

An ambiguous ampersand is a U+0026 AMPERSAND character (&) that is followed by one or more characters in the range U+0030 DIGIT ZERO (0) to U+0039 DIGIT NINE (9), U+0061 LATIN SMALL LETTER A to U+007A LATIN SMALL LETTER Z, and U+0041 LATIN CAPITAL LETTER A to U+005A LATIN CAPITAL LETTER Z, followed by a U+003B SEMICOLON character (;), where these characters do not match any of the names given in the named character references section.

The reference says:

An ambiguous ampersand is an "&" character that is followed by some text other than a space character, a "<", character, or another "&" character.