Created attachment 6989 [details]
Reduced test case
That's a great test case.
Step 3 should read: "Mouse right until the cursor is below Three but still over two, then mouse up. Two should disappear, but doesn't."
This test case is a great example of what the comment in FrameView::dispatchMouseEvent() says about not caching the old mouse-over node.
In this case, as the mouse enters "Three", the code tries to calculate which node the mouse was previously in, but while doing this, first of all it updates the document's layout applying to the already-updated hover states. According to the new layout, the previous mouse position was in "Four", so "Three Four" is sent a bogus mouse out event, and "One Two" never gets one.
Fixed, patch in bug 3439