validating input to the asp:CreateUserWizard control - asp.net

Question

I'm using the asp:CreateUserWizard control and have read on MSDN:
User input in a Web page can potentially contain malicious client
script. By default, ASP.NET Web pages validate user input to ensure
that the input does not contain HTML elements or script. As long as
this validation is enabled
This is the code I'm using:
<asp:Label runat="server" AssociatedControlID="UserName">User name</asp:Label>
<asp:TextBox runat="server" ID="UserName" CausesValidation="true"/>
<asp:RequiredFieldValidator runat="server" ControlToValidate="UserName"
CssClass="field-validation-error" ErrorMessage="User name is required." />
<asp:RegularExpressionValidator runat="server" ControlToValidate="UserName"
CssClass="field-validation-error" ErrorMessage="User name must not contain \ (backslashes)."
ValidationExpression="[^\\]*" />
Now if I try and create a user with a name like <script>alert('hello')</script> my app then crashes with a 500 internal error.
I've tried code in all these events to see if I can trap the error but the code never gets hit:
RegisterUser_CreateUserError()
RegisterUser_CreatingUser()
So my 2 questions are, why is the input not being validated and where could I trap this error when it is thrown (the 2nd question maybe less important once I know how to do the first part)?
I must be missing something really simple here.