range.end(another_range.end()) have problems with offsets in IE 7-8

Hi, I found two issues on the Range implementation causing this bug.
The first issue is that on .start() and .end() the .move() TextRange's call is missing the 'character' unit, so the whole thing causes an error.
The second one is that for some reason extending the Range prototype with a custom toString doesn't work in IE 7-8, so toString() always return '[object Object]'. What this causes is that whenever you're setting the end using another range.end() result, only the first 15 characters of the last endContainer are selected.
## The fix

Add to the global vars:

``` javascript
rangeToString = function () {
return typeof this.range.text == "string" ? this.range.text : this.range.toString();
}
```

in Range constructor, as last thing

``` javascript
if(this.toString !== rangeToString) {
this.toString = rangeToString;
}
```

and obviously change the .extend($.Range.prototype to use rangeToString instead of the function body.

For the missing unit, just change

``` javascript
var newPoint = $.Range(container).collapse();
//move it over offset characters
newPoint.range.move('character', offset);
this.move("START_TO_START", newPoint);
```

in start and

``` javascript
var newPoint = $.Range(container).collapse();
//move it over offset characters
newPoint.range.move('character', offset);
this.move("END_TO_START", newPoint);
```

in end.

Hope this helps someone!

Locate the Range implementation and inspect its constructor, start(), end(), and prototype extension. Apply the issue's offset-unit and rangeToString changes, then verify that range.end(anotherRange.end()) selects the full expected text in IE 7-8.

Written by the indexing model from the issue text.