P1, because one of the problems is a crasher. Patch forthcoming.
Created attachment 13491 [details]
Not converting to DeprecatedString in Value::toNumber() helps because DeprecatedString::ascii() has an apparent bug: all characters above 0xFF are converted to \0, so toDouble("\u2022abc") returns 0 instead of failure.
I thought about fixing this globally, but the problem is deep inside DeprecatedStringData:makeAscii(), and changing it now seems too dangerous to me.
Comment on attachment 13491 [details]
This looks good. I am not sure whether putting a comment in DeprecatedString is worth it (since it is deprecated), but perhaps noting the bug in source might be a good idea.
Committed revision 20008.