See email below from Paul Ruizendaal:
The expression /((a)|(aa))b/.exec('aab') should result in ['aab','aa',undefined,'aa']. The key here is that the 2nd capture gets reset when the left alternative is abandoned. In the spec algorithm this is automatic, as States are "copy on write"; I think many implementations will use a "save & restore" policy and then this then needs to be verified.
This is not covered by test262, but it is by the mozilla suite test "ecma_3/RegExp/regress-31316.js".
Recommend to add the following test to section 15.10.2.3:
function test() {
var rc = /((a)|(aa))b/.exec('aab');
return !rc[2];
}