I deleted the second group of two sentences in the Tcl interpreter:
     ustring = Tcl_GetUnicodeFromObj(objv[1], &length);
     length--;

I compiled and the test proposed by dkf works:
    set start end-2
    string replace $start $start end

It returns "en". The same value returned by the interpreter without any modification to its code.

Also the condition:
      objv[1]== objv[2] || objv[1] == objv[3]
doesn't happens inside the function StringRplcCmd() in this test.