http://gcc.gnu.org/bugzilla/show_bug.cgi?id=54392
--- Comment #12 from Paolo Carlini <paolo.carlini at oracle dot com> 2012-08-29 16:53:02 UTC --- Nope, unfortunately I remembered correctly: if we call _M_replace_safe for these cases the new chars are copied at the very end. At that point, the destination string is already reallocated but in these cases it's also the source string and __s doesn't point anymore to it. _M_replace_safe is exactly for when __s remains a valid address for the source chars from beginning to end of the whole operation.