The problem actually lies in the style system, in the applyInlineStyle() function. You can see the same bug with the same HTML and the same selection by pressing the bold button - nothing happens.
What happened in the applyInlineStyle() function is that the calculation of firstNode and lastNode in line 280, 281 is wrong. The lastNode calculated from there actually comes before the firstNode (you can verify by printing out their getAddress() output). We already have a more well tested way in CKEDITOR.dom.range::getBoundaryNodes() to do the same thing, so that function should be used instead.
