Created attachment 238997 [details]
Sandboxed date string conversion test case.
Given a sandboxing iFrame, after creating a Date object from the sandbox, calling date.toString() gives a different result to calling ""+date.
The automatic conversion of the date to a string when appended to a string is wrong:
""+date === 1412140297227
See attachment with test case.
This happens any time the date object is created via a different frame - it does not have to be display:none, and it doesn't have to be empty.