src/third_party/mozjs-45/js/src/jit-test/tests/basic/testBug663789-2.js

load(libdir + "evalInFrame.js");

o = { toString:function() { return evalInFrame(1, "x") } }
var x = 'C';
var s = "aaaaaaaaaa".replace(/a/g, function() { var x = 'B'; return o });
assertEq(s, "CCCCCCCCCC");