I've hit this same problem with v12. It was working fine in v11. Using a network trace on the traffic and viewing the Windows Event log it seems the issue is due to improved Request.Form validation in the .NET library. I can get this to work if I disable the .NET form validation. This article on StackOverflow covers the basics: asp.net - A potentially dangerous Request.Form value was detected from the client - Stack Overflow see the response mid way down showing the adjustments to the web.config file. This seems to only be necessary for the QvAJAXZfc virtual directory in IIS.
Note, this is only a work around. I don't believe it's a good idea to disable the automatic validation. I plan to raise a support ticket with Qlik.