Issue with Number/Bulleted list - Stack overflow at line: 27

[Rajendra]

I have very simple text in editor, when I press “Insert/Remove Numbered List” button on toolbar on 1st,2nd and 3rd line, then go back to 2nd line and press “Insert/Remove Bulleted List” button on toolbar, it is killing all IE browsers sessions.

Steps to reproduce:

1. Textarea "editor1" is associated with the instance of ckeditor, here is the text prepopulated in the textarea :

   <dl>
   	<dt>
   	Text1
   	</dt>
   	<dd>
   		<ul>
   			<li>
   				Text2</li>
   			<li>
   				Text2</li>
   			<li>
   				Text2</li>
   			<li>
   				Text2</li>
   			<li>
   				Text2</li>
   			<li>
   				Text2</li>
   		</ul>
   	</dd>
   </dl>
   

2. Click on first bulleted list make it to Numbered list
3. Click on second bulleted list make it to Numbered list
4. Click on third bulleted list make it to Numbered list
5. Click on forth bulleted list make it to Numbered list
6. Click on second numbered list which in done in point 3 above and make it to bulleted list

At this point all browser sessions get killed.

For the same above text loaded in editor if I use editor.getData() method, it is giving “Stack overflow at line: 27” error.

Browser: IE 7.0.5730.13 OS: Windows XP with SP3

Addtional info: Please note, this happnes on ​http://ckeditor.com/demo page also, if 4 numbered list items are created and then if clicked to 2nd numbered item and make it bulleted item, it kills all IE browser sessions.

[Krzysztof Studnik]

Confirmed on IE7
Similar issue on forums:
​http://cksource.com/forums/viewtopic.php?f=11&t=21785