Why does md5_crypt move bytes around? I looked into the code for md5_crypt the other day (yes, I know it's insecure), and I noticed that after mushing up everything with strange md5 hashes, it generates a base64 string with a strange order of bytes. You can see that either in the FreeBSD implementation lines 144-155 or in passlib which calls this function.

Why do they do that?
One of the candidate answers you should consider is "for no good reason."  As Provos and Mazières put it in the bcrypt USENIX paper (section 6.1.2):


  Some steps in the algorithm make it doubtful that the scheme was designed from a cryptographic point of view—for instance, the binary representation of the password length at some point determines which data is hashed, for every zero bit the first byte of the password and for every set bit the first byte of a previous hash computation.


That's remarking on a different step of the algorithm than you are, but I suspect it generalizes to the step you highlight as well.  Any halfway decent hash function is going to diffuse its state, and MD5 is no exception, so shuffling the bits of the MD5 output is just suspect.

PHK wrote a history of md5crypt that might be of some use to help us understand his mindset at the time, although it doesn't very much go into nuts and bolts, so it doesn't particularly illuminate the step in question.