Please consider this code:
It returns the string: C\Windows\, missing the colon. There's some special case for the colon in the function, but it is checked before quotes are removed, so it checks the wrong string position in this case.
A quick fix for me (or anyone else running into this) is to call unquoted on the string before passing it to createLegalPathName. However, I think this case should be handled correctly inside the function.