The only thing I can think is maybe they are processing characters 2 at a time, and messing up on the end case if there's an odd number of characters. Not sure how the uppercase comes into it though, pretty obscure.
Some demented version of .toLower() done in C, maybe? Apparently the bug first appeared in WinXP and IE6, so they could have been working without some of the better-tested library functions included with the platform now.
(Edit: can't think of a sufficiently subtle off-by-1 error for a function that does just this. Microsoft would never hire me.)