Do page arguments in hook_menu get sanitized?
In D6 

menu_execute_active_handler() calls the callback. However it gets it's arguments from menu_get_item(), which uses arg.

I can't see any sanitizing in any of that. So it looks like the answer is no.

In any case extra sanitizing can't hurt.