While working on bug #208661, I noticed that Editor::replaceSelectionWithFragment() deletes the first character at a word boundary when there is a caret selection. The expected result is that it should just insert the fragment and not perform any deletion.
Resetting 'Assigned' and changing to 'HTML Editing' to make it clearer in category to fix in future.