Title pretty much says it all. I took a look at the source, and I didn't see any escaping being done. But, I can't say for sure.
wp_localize_script( 'script-hook', 'object_name', array(
'param_1' => $value_1, // This?
'param_2' => esc_js( $value_2 ) // Or, this?
) );
var object_name = {"param_1":"<script>alert(\"xss\");<\/script>"};
no alert was triggered on initial page load. Is that conclusive?