This is a hard situation, but it does need to be dealt with. I was in a similar situation with a friend for a time. We spent a lot of time together due to being in the same church and the same circle of friends and her daughter was a year older than my twins. Her parenting methods were rather different to mine, and initially that was OK - her daughter was rather spoiled, but if it didn't directly affect my kids then I didn't say anything - each to their own.
However, when her daughter started bossing my two around, saying mean things to them and behaving in a way that was completely unacceptable, and my kids were seeing her getting away with it, I had to step in. My general rule of thumb is "my house, my rules" so if she was in my house playing and did something unacceptable and her mum didn't step in then I would with a gentle "we don't do that/speak like that in this house". If we were elsewhere however it was harder. We're a tight knit group of friends who all look out for each other's kids and I think that made it a bit easier. If one of mine did something unacceptable and I was unable to do anything about it because I didn't see it, or was otherwise engaged with another child, then I'd be more than happy for one of my friends to step in. Even without that though - if something is done to my child that is plain wrong (and I'm not talking about accidents or general childhood silliness) and the other parent doesn't say anything then I will. I'm never mean about it, but I am firm while still being gentle. Something along the lines of "Now X, that wasn't very kind - why don't you say sorry and then we can all play nicely together." I am very clear on doing the same for my kids too - they are no angels so I'm not picking on one child in particular. It could, as you say, be misplaced affection - a boy was like this with my eldest when they were about 5/6 years old. He kept doing weird things to him (like sticking blutac in his hair, putting paint on his school shirt etc) and constantly called him names. I knew the homelife was a little difficult though and he was a child who just didn't know how to socialise and make friends properly. I had to tell my son to stay away from him when it was just the two of them, and to be wary, but not to cut him out and to try to brush off the name calling.
With this little girl it was harder though because the parents were always there. With my son the mum wasn't around because it was always happening at school and that is a big difference - behaviour is one thing, letting a child away with that behaviour is a whole other issue.
On one occasion my two girls, this other girl (X), and another girl (Y) were all waiting to go to the loo. One of my girls had got there first and was just about to go in when X pushed her out of the way - she pushed her so hard that she fell against the fire door which opened and she fell down the 2 steps outside the door. It sounds more dramatic than it was - she was fine, but she got a fright. The parent of Y looked at me in shock, and didn't really know what to say. I waited for X's dad to tell her off and get her to apologise, but he said nothing at all. I picked up my daughter and said that I was sure that X didn't mean to hurt her, but she would say sorry and then they'd all get to go to the loo in turns. The dad responded by telling his daughter "it's OK - you didn't mean to don't worry. Let's go to the toilet and then go back to mummy." They went to the loo while myself and the other parent stood open mouthed at the complete rejection of any kind of responsibility or apology! After that I had had enough and said no more playdates. We only saw her with a big group of people and I told my girls to stay away from this girl. I hated doing it, but it had gone too far. Sadly, another friend has also had to stop playdates because her daughter ended up in tears every time because of this girl and it was getting too much to see her get away with it all the time. Like I said - there is a big difference between behaviour which is checked, and behaviour which is unchecked.