src/third_party/mozjs-45/js/src/jit-test/tests/basic/bug572232.js

// |jit-test| error: TypeError
gczeal(11);
var o = { valueOf: function() { new Object(); gc(); return 17; } };
(new String.prototype.substring(o)).toString;