Cisco Router: Running IOS Image Is Not The Same As The Configured IOS Image In Running-Config

I came across a problem recently where my counterpart had tftp'ed a new IOS image to a voice XML gateway.  We are planning on upgrading from 12.4 to 15.1 on our voice XML gateways, which is for our UCCE environment.  As it turns out, when one of the routers got rebooted, before the upgrade, it actually booted up to the 15 code.  This caused some problems with some of our SIP stuff, so after troubleshooting, we noticed that this one gateway was running the 15 code.  Notice below the show version after a reboot (shortened for brevity):

XMLGateway#sh version
Cisco IOS Software, 5350 Software (C5350-IK9SU2-M), Version 15.1(3)T4, RELEASE SOFTWARE (fc1)
Technical Support: http://www.cisco.com/techsupport
Copyright (c) 1986-2012 by Cisco Systems, Inc.
Compiled Thu 24-May-12 07:24 by prod_rel_team

ROM: System Bootstrap, Version 12.3(12r)PI6b, RELEASE SOFTWARE (fc1)

XMLGateway uptime is 3 hours, 32 minutes
System returned to ROM by reload at 10:42:56 CST Wed Dec 4 2013
System restarted at 10:44:00 CST Wed Dec 4 2013
System image file is "flash:c5350-ik9su2-mz.151-3.T4.bin"
Last reload type: Normal Reload

-------------------------------------------------
Device#  PID SN
-------------------------------------------------
*0    AS535XM-AC-RPS        

Configuration register is 0x101


Notice that the config register is set to 0x101.  Interesting.  If you do a show run, you will notice that the boot system statements point to a different IOS (shortened for brevity):

XMLGateway#
XMLGateway#sh run
Building configuration...

Current configuration : 7905 bytes
!
version 15.1
!
boot-start-marker
boot system flash:/c5350-ik9s-mz.124-24.T3.bin
boot system flash:/c5350-is-mz.124-1c.bin
no boot startup-test
boot-end-marker
!
XMLGateway#

Notice when we look at the flash, the 15 code is the first code on the flash, hence why we are booting to that code.  See the dir flash: below:
XMLGateway#dir flash:
Directory of flash:/

    1  -rw-        1072   Sep 6 2006 15:24:38 -05:00  bootstrap.tcl
    2  -rw-    37680424  Nov 12 2013 08:47:44 -06:00  c5350-ik9su2-mz.151-3.T4.bin
    3  -rw-    33029120   Sep 6 2006 14:32:14 -05:00  c5350-ik9s-mz.124-24.T3.bin
    4  -rw-        5044   Sep 6 2006 15:24:56 -05:00  bootstrap.vxml
    5  -rw-       58446   Sep 6 2006 15:25:26 -05:00  critical_error.wav
    6  -rw-        1652   Sep 6 2006 15:25:44 -05:00  cvperror.tcl
    7  -rw-        1419   Sep 6 2006 15:25:58 -05:00  handoff.tcl
    8  -rw-         583   Sep 6 2006 15:26:12 -05:00  recovery.vxml
    9  -rw-       32110   Sep 6 2006 15:26:28 -05:00  ringback.wav
   10  -rw-        4187   Sep 6 2006 15:26:40 -05:00  ringtone.tcl
   11  -rw-      191832   May 3 2013 11:12:24 -05:00  crashinfo_20130503-211224

127918080 bytes total (56885248 bytes free)
XMLGateway#

This is what Cisco says about the config register below.  And this is what caused our problem.  Very interesting.
From a Cisco document I found:
–If the last digit of the boot field is1 (for example, 0x101), the boot helper image is loaded from ROM. (On some platforms, the boot helper image is specified by the BOOTLDR environment variable.)
–If the last digit of the boot field is 2 through F (for example, 0x102 through 0x10F), the router boots the first valid image specified in the configuration file or specified by the BOOT environment variable.