21.1.3.14 String.prototype.replace (searchValue, replaceValue )
21.2.5.7 RegExp.prototype.replace calls ToString on a non-callable replaceValue even if no match was found. Compared to that String.prototype.replace performs an early return in step 7 and does not call ToString if no match was found.
Change String.prototype.replace to call ToString on the replaceValue parameter before step 7.
Test case:
---
"a".replace("b", {toString: function(){throw 0}})
"a".replace(/b/, {toString: function(){throw 0}})
---
fixed in rev26 editor's draft
ES3&5 are not precise on this point but seem to suggest that the ToString happens after a successful match. While Chrome currently does the after match conversion, FF, IE, and Safari all do a before match conversion. So the legacy de facto standard seems to be before match conversion.
in rev26