Content being erased in html.js#toString()/for loop

This is some strange behavior.

I had the following code that extends from Active.System.HTML

SDI.ECS.Anchor = SDI.ECS.Component.subclass();

/**
 *
 */
SDI.ECS.Anchor.create = function(){

    var obj = this.prototype;
    obj.setTag("a");
    obj.setClass("ecs", "Anchor");

    obj.defineProperty( "text", "" );
    obj.defineProperty( "image", null );
    obj.defineProperty( "action", null );
    obj.setAttribute( "href",function(){return this.getAction();} );

    obj.setContent( "text", function(){
        var t = this.getText();
        return t;
    } );

    obj.setContent( "img", function() {
        var img = null;
        var imgSrc = this.getImage();
        if (imgSrc) {
            img = new Active.HTML.IMG();
            img.setAttribute( "src", IMAGES_HOME +"/"+ imgSrc );
            img.setAttribute( "border", "0" );
        }
        return img;
    } );

};

SDI.ECS.Anchor.create();

This seems to result in the last word in the text property being chopped off (unless the text ended in a space)

var a = new SDI.ECS.Anchor();
a.setText("Hello World");

Which prints an anchor tag with content of <a ...>Hello </a>

I put an alert in the HTML.js#toString()/forLoop and discovered

pass 0:
<a... >{#0}{#1}</a>

pass 1:
<a... >Hello World{#1}</a>

pass 2:

<a... >Hello </a>

...

Is this a bug, or is my code wrong?

Yes, this is a bug. You can get around by returning an empty string instead of null value in your image function (this is a side effect of handling 'checked' and similar attributes where null value should completely remove the pattern with the attribute name).