busybox:

    ~ $ var=fooXbar
    ~ $ echo ${var/X/$(printf "\x33\x88\x33\x88")}
    foo33bar
    ~ $ echo ${var/X/$(printf "\x33\x88\x33\x88")} | hexdump -C
    00000000  66 6f 6f 33 33 62 61 72  0a                       |foo33bar.|
    00000009

why is 0x88 skipped?

these bytes appear in some UTF-8 characters.

using https://busybox.net/downloads/binaries/1.28.1-defconfig-multiarch/busybox-x86_64 it even segfaults

    ~ $ x=x
    ~ $ echo ${x/x/裁}
    Segmentation fault

but in my local version it just removes a byte

    $ echo ${x/x/裁}
    è£

as a workaround, I no longer use ${/} to replace characters.