#12266 Fixes an IE9/10 Exception When a Cross-Domain iframe Exists

This Pull Request relates to [http://jqbug.com/12266](http://jqbug.com/12266). The issue involved getting an exception when trying to create nested elements such as `$( "<div><div></div></div>" )`. The initial jsFiddle used to recreate the issue was using a 3rd party script that injected an `iframe`. After some trial and error I've found a way to recreate this issue reliably in IE9/10 with a reduced test case. It was difficult to recreate under normal circumstances, so I used the `testIframeWithCallback` function and made a `test/data/manipulation/iframe-denied.html` file to assist in the testing process.

The trick was to create an `iframe` with a cross-domain source before DOM Ready. The interesting thing about IE9/10 is that anytime you add an `iframe` or an object to the DOM it will alias it's `window` object onto the `document`. For example, after adding an iframe to the DOM you can access that `iframe's` `window` object off of `document[0]`. 

![IE9 Debugger](http://f.cl.ly/items/0017361H070910022G32/12266-ie9-debugger.png)

Yes, that is weird and that is why `buildFragment` was throwing an exception because it was trying to access `context[0]`, which was the `window` object from a cross-domain `iframe`.

I testing this new Unit Test in IE6/7/8/9/10 before I applied the fix and it failed in IE9 & IE10 as expected. After applying the following fix the Unit Test passes in IE6/7/8/9/10 as well as all the other unit tests in the manipulation module.

```diff
jQuery.buildFragment = function( args, context, scripts ) {
    var fragment, cacheable, cachehit,
        first = args[ 0 ];

        // Set context from what may come in as undefined or a jQuery collection or a node
+       // Updated to fix #12266 where accessing context[0] could throw an exception in IE9/10 &
+       // also doubles as fix for #8950 where plain objects caused createDocumentFragment exception
        context = context || document;
-       context = (context[0] || context).ownerDocument || context[0] || context;
+       context = context instanceof jQuery ? context[0] : context;
+       context = context.ownerDocument || context;

-       // Ensure that an attr object doesn't incorrectly stand in as a document object
-       // Chrome and Firefox seem to allow this to occur and will throw exception
-       // Fixes #8950
-       if ( typeof context.createDocumentFragment === "undefined" ) {
-           context = document;
-       }
        ...
};
```

The above change also accounts for the bug fix that was made for #8950 where plain objects caused a createDocumentFragment exception. The above fix passes the unit test added for #8950 which is still present in the manipulation test module. Therefore, I removed the patch for #8950 since the above code accounts for that scenario as well.

By fixing the security concern related to this issue and removing the fix for #8950, which is no longer needed, it reduces the overall size of jQuery!

```text
Running "compare_size:files" (compare_size) task
Sizes - compared to master
    258224       (-51)  dist/jquery.js                                         
     92551       (-42)  dist/jquery.min.js                                     
     33117        (-5)  dist/jquery.min.js.gz   
```