src/third_party/mozjs-45/js/src/jit-test/tests/ion/bug877936-2.js

rex = RegExp("()()()()()()()()()()(z)?(y)");
a = ["sub"];
a[230] = '' + "a"
f = Function.apply(null, a);
"xyz".replace(rex, f);