I beleive your suspicions are correct!
The differences between the examples you posted that crask and do not crash looks to be dependent on what type of FP tag is passed to the typecast function in what order!
If you only do emties, Fine.
If you only do non-empties, Fine.
Do an empty followed by a non-empty ---> TROUBLE!
The above explains why the various examples you posted work/don't etc.
Please see the attached zip to explore more.
If you run my version of "allwayserror.vi" with the VI server stuff shutdown (see boolean) it demonstrates that as long as the typcast always gets the same type (i.e. empty vs non-empty) the typecast is OK.
If you turn on the VI server part of the code, you will see that if the typecast is in DIFFERENT VI's it still crashes.
I vote BUG!
Work-around: try using the "Flatten to string".
Ben