I wonder if it has something to do the the "dup" instructions.

Yep. If you look at the generated code for IL3A-3F you can easily note that dup has no effect. If you remove the dup then your compiler would generate identical code. That's a good indication that something isn't right.

So when I perform the dup operation, the two top items on the stack now contain "pStr".

dup make a copy of the value, it seems to me that your implementation makes a copy of some sort of reference to the value.