reimplement str::Replace
prevent unnecessary allocations for win::menu::ToSafeString