Inline spell-check node cache was mutated concurrently from the background scan and UI threads with no synchronization
Interactive spell-check pre-scan ran a full synchronous O(N^2) document scan on the UI thread on tables
A relative Hunspell affix (.aff) path was not rooted against the app base directory, breaking after a CWD change
German/Norwegian/Polish embedded NetSpell dictionaries broke on .NET Framework: .aff/.dic parsed as hardcoded UTF-8, ignoring the SET directive
.NET Framework NetSpell user dictionary ignored the configured file path (read/saved under %APPDATA%\NetSpell instead)
Inline spell-check debounce timer could crash the process by BeginInvoke on a just-disposed control
.NET Framework spell-check suggestion generation raced the background scan (Suggest iterated a list the worker thread cleared)
Mail-merge InsertPlaceholder silently dropped the insert before the document was ready yet still fired PlaceholderInserted claiming success
Mail-merge placeholder emitted an unconditional trailing that became permanent content and corrupted spacing in merged output
Setting BaseUrl to null crashed the editor with a NullReferenceException on the timer path
WPF: a family of content APIs (Get/SetBodyHtml, class name, body text, embed-images, etc.) silently no-op because the services used the WinForms-only browser.Document with no MSHTML fallback
Paste deleted the current selection before checking there was anything to paste
Set/get element-by-id APIs: NRE on null value, whole-document rewrite when the element is missing, and XPath breakage on IDs containing an apostrophe
Print margins corrupted on non-English locales: culture-formatted decimals written into IE's margin registry values
CanPaste threw when another process held the clipboard (unguarded Clipboard.ContainsImage)
A UTF-8 clipboard probe overwrote the user's clipboard and lost all non-text formats during paste
Parsing a style string with a duplicate CSS property name threw ArgumentException (duplicate declarations are legal CSS)
Hyperlink/element HTML builders emitted attribute values without HTML encoding, corrupting markup when a value contained a quote
Localization override JSON parser mangled escape sequences and mispaired keys for non-string values
Turkish-I bug: list toggle/unlist broke on Turkish and Azerbaijani systems because tagName.ToLower() never matched "li"
Insert Image dialog interpolated alt/title/src/class into the img tag with no HTML-attribute escaping - a double quote corrupted the document
Mail-merge built-in toolbars resolved the field by DisplayName, so duplicate display names always inserted the first field's token
WinForms placeholder toolbar docked ABOVE the regular toolbars, contradicting its documentation and WPF parity
Trial-expired startup could freeze the host (reentrant BodyHtml write inside the message pump; the Form_Load freeze fix covered only the Licensed branch)
Auto-opening the purchase page crashed the host when no browser/URL handler existed (unguarded Process.Start)
Process-wide one-shot license cache could be poisoned by a validation that ran before LicenseKey was assigned, and was never invalidated on key change
Replacing the public editor.Options property was silently ignored by the services layer, which had captured the original UserOption instance
Form close could hang: EditorDispose pumped Application.DoEvents in unbounded loops waiting for browser readiness, and the finalizer ran it too
Buffered property values were permanently dropped when setup post-processing threw (timer stopped before the work, despite a catch claiming a retry)
Font-name combo closed its dropdown on every KeyDown, making keyboard navigation of the font list impossible
FontDialog.FontSize crashed with FormatException when no size was selected, and parsed with current culture after formatting with invariant
Cached Image dialog leaked the previous image's width/height/border settings into every subsequently inserted image
CSS functional colors (rgb()/rgba()) crashed Table Properties and the Style Builder Background page (ColorConverter.ConvertFromString threw)
Browse-for-image crashed the app on a routine cancel path (raw throw "File doesn't exist" inside the LinkClicked handler)
Unbounded 'while (!IsReady) DoEvents()' pump loops could spin forever or crash when the browser never became ready
