User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:2.0) Gecko/20100101 Firefox/4.0 Build Identifier: avmplus shell 1.4 release build cyclone The [[DefaultValue]] implementation doesn't seem to be conforming to either ES3 or ES5, this is visible in string concatenation or number addition. Reproducible: Always Steps to Reproduce: Execute the following expressions 1) "" + {toString: function () { return "toString" }} 2) "" + {valueOf: function () { return "valueOf" }} 3) "" + {toString: 0, valueOf: function () { return "valueOf" }} 4) "" + {valueOf: function () { return "valueOf" }, toString: /(?:)/} 5) 0 + {valueOf: function () { return 2 }} 6) 0 + {valueOf: 0} 7) 0 + {valueOf: /(?:)/, toString: function () { return 2 }} Actual Results: 1) "toString" 2) "[object Object]" 3) TypeError: Error #1006 4) "valueOf" 5) 2 6) TypeError: Error #1006 7) 2 Expected Results: 1) "toString" 2) "valueOf" 3) "valueOf" 4) "valueOf" 5) 2 6) "0[object Object]" 7) 2

This is not the same bug, i think. The problem here what we do if toString/valueOf aren't callable. I think this was fixed by Bug 645468.

Please note that this is a Tamarin-specific bug report, whereas bug 476624 is filed against "Core - JavaScript Engine". I'm going to revert the status back to "Unconfirmed".