This isn't really a bug. It is more of an omission.
When Show Smilies Table is Off, the traditional formatting button is displayed that links to pop_icon_legend.asp.
The insertsmilie function was not updated on this page, so it still inserts the smilie at the end of the message.
To update the code I replaced these lines:
Response.Write " <script language=""Javascript"" type=""text/javascript"">" & vbNewLine & _
" <!-- hide" & vbNewLine & _
" function insertsmilie(smilieface){" & vbNewLine & _
" window.opener.document.PostTopic.Message.value+=smilieface;" & vbNewLine & _
" }" & vbNewLine & _
" // -->" & vbNewLine & _
" </script>" & vbNewLine & _
...with these lines:
Response.Write " <script language=""Javascript"" type=""text/javascript"">" & vbNewLine & _
" <!-- hide" & vbNewLine & _
" function insertsmilie(smilieface) {" & vbNewLine & _
" if (window.opener.document.PostTopic.Message.createTextRange && window.opener.document.PostTopic.Message.caretPos) {" & vbNewLine & _
" var caretPos = window.opener.document.PostTopic.Message.caretPos;" & vbNewLine & _
" caretPos.text = caretPos.text.charAt(caretPos.text.length - 1) == ' ' ? smilieface + ' ' : smilieface;" & vbNewLine & _
" } else {" & vbNewLine & _
" window.opener.document.PostTopic.Message.value+=smilieface;" & vbNewLine & _
" }" & vbNewLine & _
" }" & vbNewLine & _
" // -->" & vbNewLine & _
" </script>" & vbNewLine & _
Additionally, I not sure that the sha256 include is needed in this file.
Hope this helps,
--Aaron