[QML] Cursor.rewind(2) causes crash at plugin end

Setup: Source code at Github d5fe51c (today, July 14th), compiled with latest Qt Creator under Win 7.

Steps:
1) Open any score
2) Select a portion including the last staff
3) Run the attached plugin (which just creates a cursor and rewinds it to selection end)

Result: the program crashes

Analysis:
1) If some selection exists, the method Cursor.rewind(2) (file libmscore/cursor.cpp, line 70) sets the score ImputState::_track to the 'next track' beyond the selection span (4 if last selected staff is the first, 8 if the last selected staff is the 2nd, and so on).

If the selection includes the last staff, that code line sets the ImputState::_track to a non-existent track.

2) When the plugin ends, the function MuseScore::endCmd() (file mscore/mscore.cpp, line 4083) calls MuseScore::updateImputstate() (file mscore/keyb.cpp, line 399) which in turn calls InputState::drumSet (file libmscore/input.cpp, line 51) which attemps to retrieve the drumset for that non-existent track and the program crashes.

Note: the plugin file name has a trailing "_.txt" to allow upload: remove it before launching.

M.