IE9 does weird things with the textarea cursor if you change .textContent (or .value) during a selectionchange event. (It turns out that I didn't actually properly prevent the change with this diff yet; I have a fix locally that I haven't pushed yet.)