diff --git a/dlls/mshtml/htmlelem.c b/dlls/mshtml/htmlelem.c
index 36103be..030a0d2 100644
--- a/dlls/mshtml/htmlelem.c
+++ b/dlls/mshtml/htmlelem.c
@@ -1649,6 +1649,11 @@
     HTMLElement_get_all
 };
 
+HTMLElement *unsafe_impl_from_IHTMLElement(IHTMLElement *iface)
+{
+    return iface->lpVtbl == &HTMLElementVtbl ? impl_from_IHTMLElement(iface) : NULL;
+}
+
 static inline HTMLElement *impl_from_HTMLDOMNode(HTMLDOMNode *iface)
 {
     return CONTAINING_RECORD(iface, HTMLElement, node);
diff --git a/dlls/mshtml/htmlselect.c b/dlls/mshtml/htmlselect.c
index 0d45448..fc91c2d 100644
--- a/dlls/mshtml/htmlselect.c
+++ b/dlls/mshtml/htmlselect.c
@@ -375,26 +375,44 @@
                                             VARIANT before)
 {
     HTMLSelectElement *This = impl_from_IHTMLSelectElement(iface);
-    IHTMLDOMNode *node, *tmp;
-    HRESULT hres;
+    nsIWritableVariant *nsvariant;
+    HTMLElement *element_obj;
+    nsresult nsres;
 
-    FIXME("(%p)->(%p %s): semi-stub\n", This, element, debugstr_variant(&before));
+    TRACE("(%p)->(%p %s)\n", This, element, debugstr_variant(&before));
 
-    if(V_VT(&before) != VT_EMPTY) {
+    element_obj = unsafe_impl_from_IHTMLElement(element);
+    if(!element_obj) {
+        FIXME("External IHTMLElement implementation?\n");
+        return E_INVALIDARG;
+    }
+
+    nsvariant = create_nsvariant();
+    if(!nsvariant)
+        return E_FAIL;
+
+    switch(V_VT(&before)) {
+    case VT_EMPTY:
+        nsres = nsIWritableVariant_SetAsEmpty(nsvariant);
+        break;
+    case VT_I2:
+        nsres = nsIWritableVariant_SetAsInt16(nsvariant, V_I2(&before));
+        break;
+    default:
         FIXME("unhandled before %s\n", debugstr_variant(&before));
+        nsIWritableVariant_Release(nsvariant);
         return E_NOTIMPL;
     }
 
-    hres = IHTMLElement_QueryInterface(element, &IID_IHTMLDOMNode, (void**)&node);
-    if(FAILED(hres))
-        return hres;
+    if(NS_SUCCEEDED(nsres))
+        nsres = nsIDOMHTMLSelectElement_Add(This->nsselect, element_obj->nselem, (nsIVariant*)nsvariant);
+    nsIWritableVariant_Release(nsvariant);
+    if(NS_FAILED(nsres)) {
+        ERR("Add failed: %08x\n", nsres);
+        return E_FAIL;
+    }
 
-    hres = IHTMLDOMNode_appendChild(&This->element.node.IHTMLDOMNode_iface, node, &tmp);
-    IHTMLDOMNode_Release(node);
-    if(SUCCEEDED(hres) && tmp)
-        IHTMLDOMNode_Release(tmp);
-
-    return hres;
+    return S_OK;
 }
 
 static HRESULT WINAPI HTMLSelectElement_remove(IHTMLSelectElement *iface, LONG index)
diff --git a/dlls/mshtml/mshtml_private.h b/dlls/mshtml/mshtml_private.h
index 20923e9..2385588 100644
--- a/dlls/mshtml/mshtml_private.h
+++ b/dlls/mshtml/mshtml_private.h
@@ -706,6 +706,7 @@
 HRESULT nsnode_to_nsstring(nsIDOMNode*,nsAString*) DECLSPEC_HIDDEN;
 void get_editor_controller(NSContainer*) DECLSPEC_HIDDEN;
 nsresult get_nsinterface(nsISupports*,REFIID,void**) DECLSPEC_HIDDEN;
+nsIWritableVariant *create_nsvariant(void) DECLSPEC_HIDDEN;
 
 void set_window_bscallback(HTMLWindow*,nsChannelBSC*) DECLSPEC_HIDDEN;
 void set_current_mon(HTMLWindow*,IMoniker*) DECLSPEC_HIDDEN;
@@ -802,6 +803,8 @@
 HRESULT get_node(HTMLDocumentNode*,nsIDOMNode*,BOOL,HTMLDOMNode**) DECLSPEC_HIDDEN;
 void release_nodes(HTMLDocumentNode*) DECLSPEC_HIDDEN;
 
+HTMLElement *unsafe_impl_from_IHTMLElement(IHTMLElement*) DECLSPEC_HIDDEN;
+
 void release_script_hosts(HTMLWindow*) DECLSPEC_HIDDEN;
 void connect_scripts(HTMLWindow*) DECLSPEC_HIDDEN;
 void doc_insert_script(HTMLWindow*,nsIDOMHTMLScriptElement*) DECLSPEC_HIDDEN;
diff --git a/dlls/mshtml/nsembed.c b/dlls/mshtml/nsembed.c
index 6874459..fdc6286 100644
--- a/dlls/mshtml/nsembed.c
+++ b/dlls/mshtml/nsembed.c
@@ -46,6 +46,7 @@
 #define NS_HTMLSERIALIZER_CONTRACTID "@mozilla.org/layout/contentserializer;1?mimetype=text/html"
 #define NS_EDITORCONTROLLER_CONTRACTID "@mozilla.org/editor/editorcontroller;1"
 #define NS_PREFERENCES_CONTRACTID "@mozilla.org/preferences;1"
+#define NS_VARIANT_CONTRACTID "@mozilla.org/variant;1"
 
 #define PR_UINT32_MAX 0xffffffff
 
@@ -713,6 +714,22 @@
     return ret;
 }
 
+nsIWritableVariant *create_nsvariant(void)
+{
+    nsIWritableVariant *ret = NULL;
+    nsresult nsres;
+
+    if(!pCompMgr)
+        return NULL;
+
+    nsres = nsIComponentManager_CreateInstanceByContractID(pCompMgr,
+            NS_VARIANT_CONTRACTID, NULL, &IID_nsIWritableVariant, (void**)&ret);
+    if(NS_FAILED(nsres))
+        ERR("Could not get nsIVariant\n");
+
+    return ret;
+}
+
 nsresult get_nsinterface(nsISupports *iface, REFIID riid, void **ppv)
 {
     nsIInterfaceRequestor *iface_req;
diff --git a/dlls/mshtml/nsiface.idl b/dlls/mshtml/nsiface.idl
index 6a88103..2cefaec 100644
--- a/dlls/mshtml/nsiface.idl
+++ b/dlls/mshtml/nsiface.idl
@@ -133,7 +133,6 @@
 typedef nsISupports nsINode;
 typedef nsISupports nsIStyleSheet;
 typedef nsISupports nsIStyleRule;
-typedef nsISupports nsIVariant;
 typedef nsISupports nsIDOMUserDataHandler;
 typedef nsISupports nsIDocShellLoadInfo;
 typedef nsISupports nsISHEntry;
@@ -286,6 +285,82 @@
 
 [
     object,
+    uuid(81e4c2de-acac-4ad6-901a-b5fb1b851a0d),
+    local
+]
+interface nsIVariant : nsISupports
+{
+    nsresult GetDataType(PRUint16 *aDataType);
+    nsresult GetAsInt8(PRUint8 *_retval);
+    nsresult GetAsInt16(PRInt16 *_retval);
+    nsresult GetAsInt32(PRInt32 *_retval);
+    nsresult GetAsInt64(PRInt64 *_retval);
+    nsresult GetAsUint8(PRUint8 *_retval);
+    nsresult GetAsUint16(PRUint16 *_retval);
+    nsresult GetAsUint32(PRUint32 *_retval);
+    nsresult GetAsUint64(PRUint64 *_retval);
+    nsresult GetAsFloat(float *_retval);
+    nsresult GetAsDouble(double *_retval);
+    nsresult GetAsBool(PRBool *_retval);
+    nsresult GetAsChar(char *_retval);
+    nsresult GetAsWChar(PRUnichar *_retval);
+    nsresult GetAsID(nsID *retval);
+    nsresult GetAsAString(nsAString *_retval);
+    nsresult GetAsDOMString(nsAString *_retval);
+    nsresult GetAsACString(nsACString *_retval);
+    nsresult GetAsAUTF8String(nsACString *_retval);
+    nsresult GetAsString(char * *_retval);
+    nsresult GetAsWString(PRUnichar * *_retval);
+    nsresult GetAsISupports(nsISupports * *_retval);
+    nsresult GetAsJSVal(long /*jsval*/ *_retval);
+    nsresult GetAsInterface(nsIID **iid, void **iface);
+    nsresult GetAsArray(PRUint16 *type, nsIID *iid, PRUint32 *count, void **ptr);
+    nsresult GetAsStringWithSize(PRUint32 *size, char **str);
+    nsresult GetAsWStringWithSize(PRUint32 *size, PRUnichar **str);
+}
+
+[
+    object,
+    uuid(5586a590-8c82-11d5-90f3-0010a4e73d9a),
+    local
+]
+interface nsIWritableVariant : nsIVariant
+{
+    nsresult GetWritable(PRBool *aWritable);
+    nsresult SetWritable(PRBool aWritable);
+    nsresult SetAsInt8(PRUint8 aValue);
+    nsresult SetAsInt16(PRInt16 aValue);
+    nsresult SetAsInt32(PRInt32 aValue);
+    nsresult SetAsInt64(PRInt64 aValue);
+    nsresult SetAsUint8(PRUint8 aValue);
+    nsresult SetAsUint16(PRUint16 aValue);
+    nsresult SetAsUint32(PRUint32 aValue);
+    nsresult SetAsUint64(PRUint64 aValue);
+    nsresult SetAsFloat(float aValue);
+    nsresult SetAsDouble(double aValue);
+    nsresult SetAsBool(PRBool aValue);
+    nsresult SetAsChar(char aValue);
+    nsresult SetAsWChar(PRUnichar aValue);
+    nsresult SetAsID(const nsID *aValue);
+    nsresult SetAsAString(const nsAString *aValue);
+    nsresult SetAsDOMString(const nsAString *aValue);
+    nsresult SetAsACString(const nsACString *aValue);
+    nsresult SetAsAUTF8String(const nsACString *aValue);
+    nsresult SetAsString(const char * aValue);
+    nsresult SetAsWString(const PRUnichar * aValue);
+    nsresult SetAsISupports(nsISupports *aValue);
+    nsresult SetAsInterface(const nsIID *iid, void *iface);
+    nsresult SetAsArray(PRUint16 type, const nsIID *iid, PRUint32 count, void *ptr);
+    nsresult SetAsStringWithSize(PRUint32 size, const char *str);
+    nsresult SetAsWStringWithSize(PRUint32 size, const PRUnichar *str);
+    nsresult SetAsVoid();
+    nsresult SetAsEmpty();
+    nsresult SetAsEmptyArray();
+    nsresult SetFromVariant(nsIVariant *aValue);
+}
+
+[
+    object,
     uuid(fa9c7f6c-61b3-11d4-9877-00c04fa0cf4a),
     local
 ]