Fix -[replaceCharactersInRange:withString:].

The resizing is now done before the memmove() if the new string is
bigger and after the memmove() if the new string is shorter. The added
comment explains why this is necessary.

This also adds a test for -[replaceCharactersInRange:withString:] that
makes the string bigger and another one that makes it smaller again.