Steve, failsafe only starts after filesystem, so its not anything in the mounting of the regular filesystems:
start on filesystem and net-device-up IFACE=lo
The interactions here are difficult to debug because when failsafe stops, nothing clears the message from plymouth, so its entirely possible that failsafe has already exited, but plymouth has not.
I agree that /etc/init.d/rcS seems a likely place where things might be stuck. Perhaps failsafe.conf should 'stop on starting rc-sysinit' ?