Was multiplying strlen(camelCase) by two a a worst case...

Yes, I think that was my reasoning for the 2x (It's been a while).

Any overreach is cleaned up by the realloc at the end so I am not left holding more memory than was actually needed.

the memory space to which you are writing is not guaranteed to not contain integer values other than 0, so whatever happens to be there becomes part of the c-string result automatically, given that there needs to be a null terminator to define the end of a c-string

It's actually already a pointer, and *text dereferences it, same as text[0], but with the benefit of allowing the post-increment operator. (Hmm, will text++[0] work? I forget.)