Potential fix for http://core.tcl.tk/tcl/tktview?name=c6ed4acfd8
Simple typo in original fix for 336441ed59. Was looping on
statePtr->next instead of statePtr2->next. Would result in
an infinite loop. Definitely a bug but whether it completely
fixes the above in all cases needs to be tested.