Testcase:

http://software.hixie.ch/utilities/js/live-dom-viewer/saved/1062

This does replaceData(1, 1, "uu") on a text node "foo".  A range collapsed like "fo[]o" then becomes "f[]uuo" per the current spec.  This is because first you delete one character, so it becomes "f[]o", then you insert the new characters, and insertions always go after a boundary point.  If you instead inserted them before the substring to be deleted, then deleted the substring, it would first be "fuuo[]o", then "fuu[]o".  Then the boundary point goes where it logically belongs -- after the replacement for the thing it was already after.

The current spec matches the behavior of IE9, Firefox 6.0a2, and Chrome 14 dev (they log "1" in the test).  Opera 11.50 matches my proposed behavior (logs "3").  I don't think this would affect compat, so switching to Opera's behavior should be safe.

To be clear, I'm asking that the spec be changed to say something like

"The replaceData(offset, count, data) method must act as if the insertData() method is invoked with offset and data as arguments followed by the deleteData() method with (offset + data.length) and count as arguments and re-throw any exceptions these methods might have thrown."

AFAIK, this should only affect range mutations (for the better) and mutation events (unlikely to make a compat difference, I hope).