The undo logic of FCKeditor does not save an undo snapshot for every character you typed, because that does not make sense. In fact, for typing actions, it saves an undo step for every 25th character you typed.
While I could easily reproduce the caret jumping phenomenon by repeating your steps. I noticed that the caret jumped to the end because previously I had been typing at final paragraph, and so the caret jumped to where I was typing when it saved an undo snapshot, which is correct. If you have typed, say, 40 random characters to the end of paragraph 1 at step 4, then the caret shouldn't jump to the end. If it does, then it is a bug.
I'm not sure if you're meeting something very different from me (I'm using both IE7 and 6 on the nightly test page). But to me, it seems to be working correctly.
