Math and JSON are no longer special cased in 19.1.4.6, but instead use the general @@toStringTag mechanism. But per the restriction in step 18.e `Math.toString()` currently returns `"[object ~Math]"`.
Also the NOTE isn't actually accurate anymore:
> The above definition of toString preserves the ability to use it as a reliable test
> for those specific kinds of built-in objects but it does not provide a reliable type
> testing mechanism for other kinds of built-in or program defined objects.
js> Object.defineProperty(Math, Symbol.toStringTag, {value: "NotMath"}).toString()
"[object NotMath]"
IIRC the current censoring approach is not yet set in stone, just a heads-up from me.
(In reply to comment #0)
> Also the NOTE isn't actually accurate anymore:
Ah, manual @@toStringTag overrides are considered ok (bug 1459, comment 3), didn't remember that one when reporting this bug.
fixed in rev20 editor's draft
[[Class]] tagging for Math and JSON was added in ES5 specifically to support toString. Prior to that they were [[Class]]=="Object" I don't think any one currently can rely on the toString result for those objects.
fixed in rev20 draft, Oct. 28, 2013