This line didn't work at mshortcuts at config.h:
/* mask button function arg release */
{ ShiftMask, Button2, selpaste, {.i = 0}, 1 },
and now it does work.
The issue was that XButtonEvent.state is "the logical state ... just prior
to the event", which means that on release the state has the Button2Mask
bit set because button2 was down just before it was released.
The issue didn't manifest with the default shift + middle-click on release
(to override mouse mode) because its specified modifier is XK_ANY_MOD, at
which case match(...) ignores any specific bits and simply returns true.
The issue also doesn't manifest on press, because prior to the event
Button<N> was not down and its mask bit is not set.
Fix by filtering out the mask of the button which we're currently matching.
We could have said "well, that's how button events behave, you should
use ShiftMask|Button2Mask for release", but this both not obvious to
figure out, and specifically here always filtering does not prevent
configuring any useful modifiers combination. So it's a win-win.