In this case, innerHTML cannot be trusted, so fall back to a simpler, non-conformant implementation that previous versions of Rangy used (with the exception of using a body element rather than a div)
function(fragmentStr) {
            assertNotDetached(this);
            var doc = getRangeDocument(this);
            var el = doc.createElement("body");
            el.innerHTML = fragmentStr;

            return dom.fragmentFromNodeChildren(el);
        }