BString: fix possible infinite loop in _DoReplace