I believe the summary says everything. I have tested this on Mac OS X 10.4 and Windows with the nightly build. Interestingly enough setting the innerHTML of an element to ' ' works. I came across this bug using Prototype 1.6.0 RC0, which sets innerHTML to a blank string before inserting a new DOM node. FYI, DOM Exception 7 is NO_MODIFICATION_ALLOWED_ERR.
Created attachment 16630 [details] Basic test
Test case passes on Firefox 2.0.0.7 and Opera 9.22, but fails on a local debug build of WebKit r26376 with Safari 3 Public Beta v. 3.0.3 (522.12.1) on Mac OS X 10.4.10 (8R218).
Created attachment 16887 [details] proposed fix
Comment on attachment 16887 [details] proposed fix r=me
Committed revision 27144.