The @@create property for built-in constructors is currently defined as configurable=true, it may be necessary to review whether this creates any hazards when users redefine the @@create property.
For example 8.2.3.3 needs to be make clear that the term "a newly created TypeError object" does not mean to call the [[Construct]] function of built-in native errors, because 15.11.6.1.2 calls OrdinaryConstruct and OrdinaryConstruct calls @@create.
9.1.9 ToObject must not call [[Construct]] on the Boolean/Number/String constructor (this is currently only implicitly stated because the result object must have a [[BooleanData]] / [[NumberData]] / [[StringData]] internal data property)
11.1.8 needs to be changed to call RegExpCreate instead of creating a new object `as if by the expression new RegExp(Pattern, Flags)` (see bug 749).
15.9.2.{1,2,3} step 5 needs to be changed because Date[@@create]] might have been redefined (`if by the expression (new Date()).toString()` !)
There is also an observable change at the user level for certain built-in constructors. For example just calling `TypeError()` or constructing a new object by `new TypeError()` gave the same results in ES5, given that `TypeError` is the original TypeError constructor. In ES6 with a configurable TypeError[@@create] `TypeError()` and `new TypeError()` can give different results.
fixed in rev28 editor's draft
fixed in rev28