Infinite loop in fragment case

Setting innerHTML on a select element to a start tag of one of "input", 
"keygen", "textarea" causes an infinite loop. You have to act as if a 
"select" end tag has been seen, before reprocessing the token, but then 
you ignore the "select" end tag in fragment case, hence reprocessing the 
token in the same state, leading you on your way to an infinite loop. 
It'd be kinda nice to fix this.

-- 
Geoffrey Sneddon — Opera Software
<http://gsnedders.com/>
<http://www.opera.com/>