the following trivial test program triggers a bug in RE.subst:

import org.apache.regexp.*;
import java.io.*; 
import java.text.*; 
import java.util.*; 
public class test
{ 
    public static void main(String[] args)
    {
	RE regexp = new RE("http://(.*)/(.*)");
	String test = "http://www.apache.org/test";
	System.out.println(regexp.subst(test, "host: $1",
					RE.REPLACE_BACKREFERENCES));
	System.out.println(regexp.subst(test, "dir: $2",
					RE.REPLACE_BACKREFERENCES));
    }
}

outputs:

st: www.apache.org
r: test

instead of:

host: www.apache.org
dir: test