21.1.3.11 String.prototype.match
21.1.3.15 String.prototype.search
When the matcher/searcher found in step 4 is undefined, a new regexp is constructed in step 7a, but the original undefined matcher/searcher is incorrectly used in step 9.
A step 7b should be added:
  Let matcher/searcher be the original value of RegExp.prototype[@@match/@@search].
fixed in rev30 editor's draft.
Several bugs besides the ones mentioned here.  Also fixes in replace and split.
Here's what match now looks like
1.	Let O be RequireObjectCoercible(this value).
2.	Let S be ToString(O).
3.	ReturnIfAbrupt(S).
4.	Let matcher be GetMethod(regexp, @@match).
5.	ReturnIfAbrupt(matcher).
6.	If matcher is not undefined, then
    a.	   Return  Call(matcher, regexp, «S»).
7.	Let rx be RegExpCreate(regexp, undefined) (see .2.3.3).
8.	Return Invoke(rx, @@match, «S»).
*** Bug 3444 has been marked as a duplicate of this bug. ***
fixed in rev30