IE11 Blows up on td or th with rowspan attribute when rowspan is allowed by config

[mjuniper]

This jsbin demonstrates the problem:
https://jsbin.com/gipeze/edit?html,js,output

The above works in chrome but blows up in IE11.

I think it is blowing up on this line when it encounters the rowspan.

[freginold]

I get the same issue using either rowspan or colspan in IE11 but other td attributes (like align) don't give it a problem. Like you said, @mjuniper -- the problem seems to be with that line... if you comment it out, it runs the rest of the code.

[mjuniper]

I don't know if this is because of an ie update but it now fails on plain button elements in IE11.

Update: buttons fail only with this in the config:

add_attributes: {
    button: {'type': 'button'}
  },