fix bug 1056953 - Use DOM operations to inject content instead of innerHTML

https://bugzilla.mozilla.org/show_bug.cgi?id=1056953

This is mostly a nit but has functional implications too.  It's safer to go this route so that we don't release event connections to elements before we process them as notifications.