I distinctly remember from the early days of .NET that calling ToString on a StringBuilder used to provide the new string object (to be returned) with the internal char buff
I hadn't seen this before, so here's my guess: the internal storage of a StringBuilder appears to no longer be a simple string, but a set of 'chunks'. ToString can't return a reference to this internal string because it no longer exists.