IE8 - crash when replace text with textfield, text area, and radio button.

[Jennifer]

Against the nightly build, in IE8, browser crashes when you highlight on a text and replace it with a text field/textarea/radio button.

Steps to reproduce: ->Type some text in ckeditor ->highlight the text ->Click on the text field/textarea/radio button plugin and click OK ->Browser crashes

This error doesn't occur with checkboxes.

Environment: XP/IE8, with or without compatibility view.

[Jakub Ś]

Reproducible in IE8 only from CKEditor 3.6.3 rev. [7384].

[Jakub Ś]

The same thing is happening when inserting link to image:

1. Open replacebycode sample in IE8
2. Select text ^You are us^ing
3. Open image dialog and insert this link - ​https://upload.wikimedia.org/wikipedia/commons/thumb/f/f9/Wiktionary_small.svg/350px-Wiktionary_small.svg.png
4. Click OK.

Result: browser crashes.

[Jakub Ś]

#9466 was marked as duplicate.

[Michael]

This is still an issue in 3.6.5