in String::replaceCharacters(), the following assertion could eventually be added :
jassert (charactersToReplace.length() == charactersToInsertInstead.length());
(the doc says "the two strings passed in must be the same length", but if you don't read it, you'll get unexpected results :)