I've attached a testcase that shows that Webkit's JS engine is no longer properly processing '$$' when present in a replace() using a RegExp, where the replacement is a String (in Safari 3.2.X, this is working fine).
Within the replacement String, '$' is used as a metacharacter along with a number or other special character to reference part of a match. Therefore, to output a '$', you need to use '$$'. This should output a single '$'.
But in the latest Webkit builds (I'm using r40000), a '$$' is output when this syntax is used. All other browsers, FF 3.0.X, IE7+, Chrome properly process this (as does Safari as mentioned above).
I've attached a small testcase.
Created attachment 26830 [details]
A testcase demonstrating how '$$' is broken.
Created attachment 26849 [details]
Verified fixed in build 40102.