I'm not completely sure about that. The string does not have to be zero-terminated unless c_str() was called. At least I think so. It's a bit hot here.
According to cplusplus.com: "If pos is equal to the string length, the function returns a reference to a null character ('\0')."
Which seems like a sane definition.