More triplet problems - causes crash

Additionally to the triplet problems in
issue #14648: Copying from within a tuplet bracket to the same or another or to a normal rest produces strange results which was resolved by disallowing the operation and in
#issue 3057: copying straight chords into tuplet brackets causes corruption more problems exist. This one was reported by Lasconic:
1) Enter two measures of 8th notes tuplet
2) Copy the first tuplet (3notes)
3) Paste on the second note of the first tuplet in measure 2 (see arrow):

In the trunk this operation crashes on an abort:

in the branch it causes corruption:

Looking in the inspector you see the corruption in the second bar, four tuplets, not 12 but 11 chords, one chord belonging to two tuplets.

I should mention: the problems is in Score:pasteStaff in cmd.cpp.

And also very important: I applied the patch from issue #14648 , otherwise I wouldn't be able select the complete tuplet to copy it. So please don't tell me that you can't reproduce it ;-)

Windows R5339.