The Undo stack gets hosed by TinyMCE's custom Undo. In "custom-undo" mode, TinyMCE use execCommand(Undo, ...) to implement Undo, it uses setInnerHTML, and our Undo stack isn't bulletproof against arbitrary DOM operations.
I meant to say "In 'custom-undo' mode, TinyMCE DOESN'T use execCommand(Undo, ...)..." in my comments above.
I haven't seen crashes caused by this bug as long as I've been working on the editing. So I'd assume we've worked out all the kinks in undo/redo by now. Please file more specific bugs and/or re-open this bug if you find specific crashes or unexpected behavior caused by this bug.