I replaced the body of the function StringRplcCmd with only this code "return TCL_OK;" and the test
    set start end-2
    string replace $start $start end
continues working.

This means that the Tcl Interpreter doesn't call StringRplcCmd. I suppose that it calls "TclCompileStringReplaceCmd" instead.