Currently dump-as-markup.js only dumps selection endpoints when they are in text nodes. Should fix it so they get dumped even when they are not in text nodes.
Strange, there does seem to be code to to this in dump-as-markup; not sure why it's not working.
I see what the problem is. The dump-as-markup.js script already handles this fine. The problem is that WebKit moves the selection endpoints. And it will stop doing so when we turn on the live range selection support, which means we are going to get very different results from all those tests!