Line 2318 of revision 220.127.116.11 of generic/tclCmdMZ.c
calls Tcl_UtfPrev(). On the first pass through the
loop, the first argument is actually a pointer to one
byte past the end of the stringrep. Tcl_UtfPrev()
is documented to accept a "pointer to some location
in a UTF-8 string".
Currently this is safe, but if Tcl_UtfPrev() is ever
changed to match its documentation
(see Tcl Bug 769895), there may be trouble here.