What CHARSET is in use on the site? Noting that the OPC's observer class (where the hashSession method resides) attempts to convert those HTML entities into their character counterparts:
Code:
        // -----
        // Add the order's current total to the blob that's being hashed, so that changes in the total based on
        // payment-module selection can be properly detected (e.g. COD fee).
        //
        // Some currencies use a non-ASCII symbol for its symbol, e.g. £.  To ensure that we don't get into
        // a checkout-loop, make sure that the order's current total is scrubbed to convert any "HTML entities"
        // into their character representation.
        //
        // This is needed since the order's current total, as passed into the confirmation page, is created by
        // javascript that captures the character representation of any symbols.
        //
        // Note: Some templates also include carriage-returns within the total's display, so remove them from
        // the mix, too!
        //
        $current_order_total = str_replace(array("\n", "\r"), '', $current_order_total);
        $session_data['order_current_total'] = html_entity_decode($current_order_total, ENT_COMPAT, CHARSET);