Do page arguments in hook_menu get sanitized? The title pretty much says it all.

If a callback is defined in a hook_menu, such as 

function mymodule_menu ()
{
    $items = array();

    $items["mymodule/foo/%"] = array(
        "page callback" => "mymodule_foo",
        "page arguments" => array(2),
        "access arguments" => array("mymodule permission"),
        "type" => MENU_CALLBACK,
    );

    return $items;
}

function mymodule_foo ($parameter)
{
    // do stuff
}

When the callback gets called, has $parameter been sanitized, or is this the responsibility of the module?

I always sanitize in the module, but have never seen this stated either way and haven't found where callbacks get called from core.
In D6 

menu_execute_active_handler() calls the callback. However it gets it's arguments from menu_get_item(), which uses arg.

I can't see any sanitizing in any of that. So it looks like the answer is no.

In any case extra sanitizing can't hurt.