It should check if the value is a cell in addition to checking if its payload matches that which was patched.
Created attachment 118146 [details] the patch
Landed in http://trac.webkit.org/changeset/102200
Comment on attachment 118146 [details] the patch Clearing flags.