Index: /CKEditor/trunk/CHANGES.html
===================================================================
--- /CKEditor/trunk/CHANGES.html	(revision 7382)
+++ /CKEditor/trunk/CHANGES.html	(revision 7383)
@@ -56,4 +56,5 @@
 		<li><a href="http://dev.ckeditor.com/ticket/8630">#8630</a> : HTML events disabled when loading data.</li>
 		<li><a href="http://dev.ckeditor.com/ticket/8433">#8433</a> : [IE9] Use W3C event model.</li>
+		<li><a href="http://dev.ckeditor.com/ticket/8691">#8691</a> : [IE] Fix paste invalid HTML crashes browser.</li>
 	</ul>
 	<h3>
Index: /CKEditor/trunk/_source/plugins/clipboard/plugin.js
===================================================================
--- /CKEditor/trunk/_source/plugins/clipboard/plugin.js	(revision 7382)
+++ /CKEditor/trunk/_source/plugins/clipboard/plugin.js	(revision 7383)
@@ -232,5 +232,4 @@
 				editor.document.getBody().focus();
 
-			pastebin.remove();
 			editor.removeListener( 'selectionChange', cancel );
 
@@ -245,5 +244,7 @@
 							bogusSpan : pastebin );
 
+			// IE7: selection must go before removing paste. (#8691)
 			sel.selectBookmarks( bms );
+			pastebin.remove();
 			callback( pastebin[ 'get' + ( mode == 'text' ? 'Value' : 'Html' ) ]() );
 		}, 0 );