Circumventing the Java language rules via reflection isn't "really" mutability. By that measure immutability is impossible in the JVM.
If your app was running under a security manager it would fail in runtime in any version of the JVM which is why String is immutable. This is actually enforced by the TCK since string mutability can be used for various attacks by untrusted code.