see
http://iirf.codeplex.com/discussions/278689
ApplyCaseConversionInPlace stomps the trailing #E, in a #X..#E pair.
I don't know how this ever worked, but for sure it is not working now.
During processing of the replacement string, first IIRF inserts Server variables, then does case conversion, then does URL encoding. The case conversion will stomp the end-flag for url encoding, even if no case conversion is performed. The result is that no url encoding ever gets done.