Make sure that injection of object elements continues to work in IE 6. Really...

Make sure that injection of object elements continues to work in IE 6. Really hard to unit test this in a meanigful manner (the result is a visually broken plugin). Will need to be diligent about watching for this in the future. Fixes #5094.

src/manipulation.js

@@ -226,7 +226,7 @@ jQuery.fn.extend({
 				null;
 
 		// See if we can take a shortcut and just use innerHTML
-		} else if ( typeof value === "string" && !/<script/i.test( value ) &&
+		} else if ( typeof value === "string" && !/<script|<object/i.test( value ) &&
 			(jQuery.support.leadingWhitespace || !rleadingWhitespace.test( value )) &&
 			!wrapMap[ (rtagName.exec( value ) || ["", ""])[1].toLowerCase() ] ) {
 
@@ -389,9 +389,11 @@ function buildFragment( args, nodes, scripts ) {
 
 	// Only cache "small" (1/2 KB) strings that are associated with the main document
 	// Cloning options loses the selected state, so don't cache them
+	// IE 6 doesn't like it when you put <object> elements in a fragment
 	// Also, WebKit does not clone 'checked' attributes on cloneNode, so don't cache
 	if ( args.length === 1 && typeof args[0] === "string" && args[0].length < 512 && doc === document &&
-		args[0].indexOf("<option") < 0 && (jQuery.support.checkClone || !rchecked.test( args[0] )) ) {
+		args[0].indexOf("<option") < 0 && args[0].indexOf("<object") < 0 &&
+		(jQuery.support.checkClone || !rchecked.test( args[0] )) ) {
 
 		cacheable = true;
 		cacheresults = jQuery.fragments[ args[0] ];