WebKit/Blink can create `li` in `li`

Here's how it happens. Start with:

```
<ul>
    <li>
        foo
        <ul>
            <li>
                bar
            </li>
        </ul>
        baz
    </li>
</ul>
```

(which is totally legit) and put the caret right before 'baz'.

Now, press your favorite enter key and viola! You get an outrageous

```
<ul>
    <li>
        foo
        <ul>
            <li>
                bar
            </li>
        </ul>
        <li>
            <br />
        </li>
        baz
    </li>
</ul>
```

Other engines don't get hit.
So, I don't know if this test code works because the DOM gets manipulated.