Clarify that the parser can insert elements into plaintext elements

Resolves #8009.

Author: dmsnell

source

@@ -128949,9 +128949,12 @@ document.body.appendChild(text);
 
     <p>Switch the tokenizer to the <span>PLAINTEXT state</span>.</p>
 
-    <p class="note">Once a start tag with the tag name "plaintext" has been seen, that will be the
-    last token ever seen other than character tokens (and the end-of-file token), because there is
-    no way to switch out of the <span>PLAINTEXT state</span>.</p>
+    <p class="note">Once a start tag with the tag name "plaintext" has been seen, all remaining
+    tokens will be character tokens (and a final end-of-file token) because there is no way to
+    switch the tokenizer out of the <span>PLAINTEXT state</span>. However, as the tree builder
+    remains in its existing insertion mode, it might <span>reconstruct the active formatting
+    elements</span> while processing those character tokens. This means that the parser can
+    insert other elements into the <code>plaintext</code> element.</p>
    </dd>
 
    <!-- button is a hybrid -->