ValidateInputAttribute not used in custom Controller Factory

Question

I use the following Controller Factory with StructureMap:

public class ShopControllerFactory : DefaultControllerFactory
{
    protected override IController GetControllerInstance(Type controllerType)
    {
        if (controllerType == null)  throw new HttpException(404, "Controller Not found");
        try
        {
            return ObjectFactory.GetInstance(controllerType) as Controller;
        }
        catch (StructureMapException)
        {
            System.Diagnostics.Debug.WriteLine(ObjectFactory.WhatDoIHave());
            throw;
        }
    }
}

When I decorate an action with

[ValidateInput(false)]
public ActionResult DebugAttribute(HomeViewModel model)
{
    return View("DebugAttribute");
}

I still get an error when I post invalid data to this action. As soon as I use the Default Controller Factory I can post dangerous input to it.

What is wrong here?

EDIT I am lucky today. When trying to debug into the MVC - source the problem disapeared.