Why, yes, you can register an XSS attack as a UK company name. How do we know that? Someone actually did it

And the 'acceptable company name' charset is hardcoded... in legislation

Companies House has blocked someone who registered a new biz with a name that contained the right characters arranged in the right order to trigger a cross-site scripting (XSS) attack against users of the service's API....