ECMA-262, 5th edition, 15.11.7.7: "Each NativeError prototype object is an Error object (its [[Class]] is "Error")" Object.prototype.toString.call(TypeError.prototype) produces "[object Object]" with JSC, whereas SpiderMonkey and V8 both produce "[object Error"], as expected. Same for the other *Error prototypes.
This does not appear to be covered by any Sputnik test.
*** This bug has been marked as a duplicate of bug 55346 ***