Index: /CKEditor/trunk/CHANGES.html
===================================================================
--- /CKEditor/trunk/CHANGES.html	(revision 6949)
+++ /CKEditor/trunk/CHANGES.html	(revision 6950)
@@ -68,4 +68,5 @@
 		<li><a href="http://dev.ckeditor.com/ticket/6671">#6671</a> : [FF] Selection of an item from the Styles drop-down list not refreshed.</li>
 		<li><a href="http://dev.ckeditor.com/ticket/7879">#7879</a> : Style and Height/Width fields of the Table Properties dialog window were not synchronized.</li>
+		<li><a href="http://dev.ckeditor.com/ticket/7581">#7581</a> : [IE] Enter key at the end of list item with "start" attribute crashes the browser.</li>
 		<li>Updated the following language files:<ul>
 			<li><a href="http://dev.ckeditor.com/ticket/7834">#7834</a> : Dutch;</li>
Index: /CKEditor/trunk/_source/plugins/enterkey/plugin.js
===================================================================
--- /CKEditor/trunk/_source/plugins/enterkey/plugin.js	(revision 6949)
+++ /CKEditor/trunk/_source/plugins/enterkey/plugin.js	(revision 6950)
@@ -130,6 +130,4 @@
 						// Otherwise, duplicate the previous block.
 						newBlock = previousBlock.clone();
-						// Value attribute of list item should not be duplicated (#7330).
-						newBlock.is( 'li' ) && newBlock.removeAttribute( 'value' );
 					}
 				}
@@ -180,4 +178,8 @@
 				if ( !newBlock.getParent() )
 					range.insertNode( newBlock );
+
+				// list item start number should not be duplicated (#7330), but we need
+				// to remove the attribute after it's onto the DOM tree because of old IEs (#7581).
+				newBlock.is( 'li' ) && newBlock.removeAttribute( 'value' );
 
 				// This is tricky, but to make the new block visible correctly