From Roger Hoover at Apple

I recently fixed a bug in Apple's Java SE 6 hotspot introduced by merging 6u25, and since
open jdk7 has the same code ....

Back in 2005, Apple's performance team forced us to fix all memory leaks in Java. One of
these fixes was to argument processing at the end of bool Arguments::add_property(const
char* prop):

--- Hotspot/trunk/src/share/vm/runtime/arguments.cpp
+++ Hotspot/trunk/src/share/vm/runtime/arguments.cpp
@@ -813,4 +813,8 @@
   // Create new property and add at the end of the list
   PropertyList_unique_add(&_system_properties, key, value);
+ FreeHeap(key);
+ if (eq != NULL) {
+ FreeHeap(value);
+ }
   return true;
 }

Unfortunately, the hotspot in the 6u25 update makes a change that relies upon this leak.
(Not that PropertyList_unique_add copies key and value):
@@ -927,9 +992,7 @@
   } else if (strcmp(key, "sun.java.command") == 0) {
     _java_command = value;

- // don't add this property to the properties exposed to the java application
- FreeHeap(key);
- return true;
+ // Record value in Arguments, but let it get passed to Java.
   } else if (strcmp(key, "sun.jva.launcher.pid") == 0) {
     // launcher.pid property is private and is processed
     // in process_sun_java_launcher_properties();

I changed the apple version to allocate new space for _java_command, but in jdk7 all
args that fall through to the end lead except for sun.java.command=command.