When calling JJHTML::image() with $relative set to true, a bad image link is created in administrator when an image file exists only in JPATH_THEMES . "/$template/$folder/system/$file".

Discussion and test file at http://forum.joomla.org/viewtopic.php?f=579&t=734663

Cause:
See the statements at about line 417 of /libraries/joomla/hmtl/html.php

// Try to deal with system files in the template folder
elseif (file_exists(JPATH_THEMES . "/$template/$folder/system/$file"))
{
    $includes[] = JURI::root(true) . "/templates/$template/$folder/system/$file";
    break;
}

The file is detected in /$template/$folder/system/$file but the link builds as webroot/$template/$folder/system/$file. In administrator, the link should be built as webroot/administrator/$template/$folder/system/$file instead.

Solution:
Change

    $includes[] = JURI::root(true) . "/templates/$template/$folder/system/$file";

To:

    $includes[] = JURI::root(true) . ($app->isAdmin() ? '/administrator' : '') . "/templates/$template/$folder/system/$file";

To be honest, I don't know how this scenario would exist unless someone moved an image into /templates/$template/$folder/system. But, I thought I'd post this in case someone ran across it or the developers wanted to do a fix.