Bug 1057677 - Crash in nsHTMLEditor::DoInsertHTMLWithContext; r=ehsan