@davidben, good job!

+    // TODO: This doesn't match the real behavior; per spec, onfoo get
+    // their place in line from the /first/ time they're set from
+    // non-null. Although WebKit bumps it to the end every time it's
+    // set.
so, this comment is a little unclear, because, seems, instead of "to the end" should be "order of registion";

also,
i want to add, than Opera < 12 works similar to IE (removeEventListener will not affect current dispatch)
and 
Chrome has a bug - 
https://code.google.com/p/chromium/issues/detail?id=262570

Although, removing event listener, except currently executing, at time of dispatch is not a good idea and very rare case.