Make sure that injection of object elements continues to work in IE 6…

…. Really hard to unit test this in a meanigful manner (the result is a visually broken plugin). Will need to be diligent about watching for this in the future. Fixes #5094.

src/manipulation.js

@@ -226,7 +226,7 @@ jQuery.fn.extend({
 				null;
 
 		// See if we can take a shortcut and just use innerHTML
-		} else if ( typeof value === "string" && !/<script/i.test( value ) &&
+		} else if ( typeof value === "string" && !/<script|<object/i.test( value ) &&
 			(jQuery.support.leadingWhitespace || !rleadingWhitespace.test( value )) &&
 			!wrapMap[ (rtagName.exec( value ) || ["", ""])[1].toLowerCase() ] ) {
 
@@ -389,9 +389,11 @@ function buildFragment( args, nodes, scripts ) {
 
 	// Only cache "small" (1/2 KB) strings that are associated with the main document
 	// Cloning options loses the selected state, so don't cache them
+	// IE 6 doesn't like it when you put <object> elements in a fragment
 	// Also, WebKit does not clone 'checked' attributes on cloneNode, so don't cache
 	if ( args.length === 1 && typeof args[0] === "string" && args[0].length < 512 && doc === document &&
-		args[0].indexOf("<option") < 0 && (jQuery.support.checkClone || !rchecked.test( args[0] )) ) {
+		args[0].indexOf("<option") < 0 && args[0].indexOf("<object") < 0 &&
+		(jQuery.support.checkClone || !rchecked.test( args[0] )) ) {
 
 		cacheable = true;
 		cacheresults = jQuery.fragments[ args[0] ];