In an iframe with designMode on, if execCommand('removeformat',false,null) is called on the iframe and the selection contains an <input> element, the <input> element is removed from the document.
This also true for any image. All images within the selection get removed from the document when calling "removeFormat".
Plexode repro for the image case: http://plexode.com/eval3/#ht=%3Cdiv%20contentEditable%3D%22true%22%3EHello%20%3Cb%3EWorld!%3C%2Fb%3E%3Cbr%3E%0A%3Cimg%20src%3D%22http%3A%2F%2Fwww.google.com%2Fimages%2Flogo.gif%22%3E%3Cbr%3E%0AGoodbye!%3C%2Fdiv%3E&ohh=0&ohj=0&jt=document.execCommand('RemoveFormat'%2C%20false%2C%20undefined)%3B&ojh=0&ojj=0&ms=100&oth=0&otj=0&cex=1 click set html, then select the text plus the image, then click eval js This affects the closure editor!
This bug has been fixed since http://trac.webkit.org/changeset/70283.