IE9: in ENTER_BR table/smiley/form is inserted under br tag

[Jakub Ś]

Steps to replicate the problem

1. Enter the word "TESTING" without the quotes into CKEditor.
2. Place cursor before T and press the Enter key. (The word TESTING will be on the 2nd line with a blank line on top).
3. Place the cursor on the blank line on top of the word Testing.
4. Click on the table button. The table dialog will appear.
5. Click on the OK button on the table dialog.

Result: table/smiley/form are always inserted under br

Issue has been reproducible in IE9 only from CKEditor 3.5.3 rev [6624]

[Jakub Ś]

Same TC causes JS error in IE6-8 #8742.

[Jakub Ś]

rev [6624] has also broken #8140