Index: /CKEditor/trunk/CHANGES.html
===================================================================
--- /CKEditor/trunk/CHANGES.html	(revision 4546)
+++ /CKEditor/trunk/CHANGES.html	(revision 4547)
@@ -82,4 +82,5 @@
 		<li><a href="http://dev.fckeditor.net/ticket/4517">#4517</a> : Fixed 'dialog_backgroundCoverColor' doesn't work on IE6.</li>
 		<li><a href="http://dev.fckeditor.net/ticket/3165">#3165</a> : Fixed enter key in empty list item before nested one result in collapsed line.</li>
+		<li><a href="http://dev.fckeditor.net/ticket/4527">#4527</a> : Fixed checkbox generate invalid 'checked' attribute.</li>
 	<h3>
 		CKEditor 3.0.1</h3>
Index: /CKEditor/trunk/_source/core/dom/element.js
===================================================================
--- /CKEditor/trunk/_source/core/dom/element.js	(revision 4546)
+++ /CKEditor/trunk/_source/core/dom/element.js	(revision 4547)
@@ -426,6 +426,11 @@
 
 						case 'checked':
-							return this.$.checked;
-							break;
+						{
+							var attr = this.$.attributes.getNamedItem( name ),
+								attrValue = attr.specified ? attr.nodeValue     // For value given by parser.
+															 : this.$.checked;  // For value created via DOM interface.
+							
+							return attrValue ? 'checked' : null;
+						}
 
 						case 'style':
@@ -1329,14 +1334,20 @@
 				var attribute = attributes[n];
 
+				// Lowercase attribute name hard rule is broken for
+				// some attribute on IE, e.g. CHECKED.
+				var attrName = attribute.nodeName.toLowerCase(),
+					attrValue;
+
+				// We can set the type only once, so do it with the proper value, not copying it.
+				if ( attrName in skipAttributes )
+					continue;
+
+				if( attrName == 'checked' && ( attrValue = this.getAttribute( attrName ) ) )
+					dest.setAttribute( attrName, attrValue );
 				// IE BUG: value attribute is never specified even if it exists.
-				if ( attribute.specified ||
-				  ( CKEDITOR.env.ie && attribute.nodeValue && attribute.nodeName.toLowerCase() == 'value' ) )
-				{
-					var attrName = attribute.nodeName;
-					// We can set the type only once, so do it with the proper value, not copying it.
-					if ( attrName in skipAttributes )
-						continue;
-
-					var attrValue = this.getAttribute( attrName );
+				else if ( attribute.specified ||
+				  ( CKEDITOR.env.ie && attribute.nodeValue && attrName == 'value' ) )
+				{
+					attrValue = this.getAttribute( attrName );
 					if ( attrValue === null )
 						attrValue = attribute.nodeValue;
Index: /CKEditor/trunk/_source/plugins/forms/dialogs/checkbox.js
===================================================================
--- /CKEditor/trunk/_source/plugins/forms/dialogs/checkbox.js	(revision 4546)
+++ /CKEditor/trunk/_source/plugins/forms/dialogs/checkbox.js	(revision 4547)
@@ -80,12 +80,15 @@
 						setup : function( element )
 						{
-							this.setValue( element.getAttribute( 'value' ) || '' );
+							var value = element.getAttribute( 'value' );
+							// IE Return 'on' as default attr value.
+							this.setValue(  CKEDITOR.env.ie && value == 'on' ? '' : value  );
 						},
 						commit : function( data )
 						{
-							var element = data.element;
+							var element = data.element,
+								value = this.getValue();
 
-							if ( this.getValue() )
-								element.setAttribute( 'value', this.getValue() );
+							if ( value && !( CKEDITOR.env.ie && value == 'on' ) )
+								element.setAttribute( 'value', value );
 							else
 								element.removeAttribute( 'value' );
@@ -116,5 +119,6 @@
 									var replace = CKEDITOR.dom.element.createFromHtml( '<input type="checkbox"'
 										   + ( isChecked ? ' checked="checked"' : '' )
-										   + '></input>', editor.document );
+										   + '/>', editor.document );
+
 									element.copyAttributes( replace, { type : 1, checked : 1 } );
 									replace.replace( element );
@@ -125,6 +129,7 @@
 							else
 							{
-								if ( this.getValue() )
-									element.setAttribute( 'checked', this.getValue() );
+								var value = this.getValue();
+								if ( value )
+									element.setAttribute( 'checked', 'checked' );
 								else
 									element.removeAttribute( 'checked' );
Index: /CKEditor/trunk/_source/plugins/forms/plugin.js
===================================================================
--- /CKEditor/trunk/_source/plugins/forms/plugin.js	(revision 4546)
+++ /CKEditor/trunk/_source/plugins/forms/plugin.js	(revision 4547)
@@ -161,4 +161,28 @@
 					}
 				});
+		}
+	},
+
+	afterInit : function( editor )
+	{
+		// Cleanup certain IE form elements default values.
+		if( CKEDITOR.env.ie )
+		{
+			var dataProcessor = editor.dataProcessor,
+				htmlFilter = dataProcessor && dataProcessor.htmlFilter;
+
+			htmlFilter && htmlFilter.addRules(
+			{
+				elements :
+				{
+					input : function( input )
+					{
+						var attrs = input.attributes,
+							type = attrs.type;
+						if( type == 'checkbox' || type == 'radio' )
+							attrs.value == 'on' && delete attrs.value;
+					}
+				}
+			} );
 		}
 	},