Setting innerHTML to null sets it to "null" instead. As discussed in bug 13448, this is likely to be a problem with all settable properties, but I didn't see any follow-up bug filed (or did I just miss it?).
Created attachment 14241 [details] test case
The binding for innerHTML is not automatically generated. So unlike bug 13448, [ConvertNullToNullString] in the IDL file is not the way to fix the bug (although it would not hurt to have that there to prepare for the day when we do auto-generate the binding). The fix for this bug goes in JSHTMLElement::putValueProperty in kjs_html.cpp. Instead of value->toString(), that function needs to use valueToStringWithNullCheck() in at least some of the cases. This is a general problem area for our bindings for functions and properties that take and return strings. Many are untested about whether they should accept null or undefined as a special values or return null or undefined rather than empty string in some cases. Another problem area is that is untested is whether functions return null or undefined. I believe we return undefined in many cases where null would be better/correct.
<rdar://problem/5168940>
A more general follow up bug to bug 13448 has been filed as bug 13541.
Fixed by the first patch in bug 13722, landed in r21489.