JavaScriptCore supports a longstanding Mozilla extension whereby RegExps are callable. Mozilla decided that despite this typeof should return "object" on RegExps, otherwise too much other code breaks or gets confused. This is also proposed as a change for ES3.1. Since Mozilla has already made this change, and since it would match the typeof return from IE and Opera, we should likely make this change. In the future we could also consider removing the callable regexp extension, since it's not clear if it is needed for Web compatibility and so would let us remove a strange quirk.
*** Bug 24716 has been marked as a duplicate of this bug. ***
This works for me in ToT
Presumably fixed via bug 28285.