Collection.toArray() is specified to return an object of type Object, but since arrays are covariant, that requirement is met by any array of a subtype of Object, for example, String.
It's subtle, but it's clearly, if not explicitly, a bug to return an array of a subtype. See JDK-6260652.
Interestingly, the specification for toArray(T) says
Note that toArray(new Object) is identical in function to toArray().
which is a fine statement, but it's in the wrong place. There should be a requirement in the toArray() spec that it returns an instance whose runtime type is precisely Object.