1. Pick Rubick and level up Spell Steal
2. Create a hero from the list below and level up the named toggling spell
3. Steal the toggle spell
4. Now, cast Spell Steal on another hero to steal a new spell
5. During the cast backswing of Spell Steal, spam your toggle spell
6. Be sure to stop spamming before the new stolen spell arrives

Result: If spammed enough, each click in the spam gets executed. So even after you lost the toggle spell, Rubick still keeps on toggling it. If you get lucky, the last click of the spam togges it on (50/50 chance, since it can either end up on or off).

Expected: As soon as you lose a spell, it should not be castable or toggleable anymore.

Affected toggle spells:
1. Medusa's Split Shot
2. Troll Warlord's Berserker's Rage
3. Io's Overcharge
4. Leshrac's Pulse Nova
5. Witch Doctor's Voodoo Restoration
6. Morphling's Morph agi and str
7. Wraith King's Vampiric Aura
8. Bane's Nightmare End sub-spell (why is this even a toggle spell?)
9. Io's Spirits In and Spirits Out sub-spells
10. Phoenix' Toggle Movement sub-spell of Sun Ray

These toggle spells do not have this bug: Pudge's Rot and Medusa's Mana Shield. They stop getting toggled as soon as you lose the spell.

Here you can see how Pulse Nova continues to get toggled even after having lost the spell.

In here you can see Rubick with 5 toggle spells being active while not having any of them currently stolen.