The following class is accepted by JustIce (BCEL 5.2), whereas Sun verifier (correctly) rejects it:

Compiled from "Test.java"
public class Test extends java.lang.Object{
public Test();
  Code:
   0:   aload_0
   1:   invokespecial   #9; //Method java/lang/Object."<init>":()V
   4:   return

public static void main(java.lang.String[]);
  Code:
   0:   aload_0
   1:   iconst_0
   2:   caload
   3:   return

}

In the "main" method we are trying to read a char from an array of Strings and this is of course type-
incorrect.

My take on the solution is that in the org.apache.bcel.verifier.structurals.InstConstraintVisitor class, in 
the visitCALOAD method, there are only two checks being made: whether the index is of int type, and 
whether there is really an array on the stack.  What is missing is the check, whether the array holds 
element of 'char' type.