2.1.85 [ECMA-262-1999] Section 15.5.4.11, String.prototype.replace (searchValue, replaceValue)

V0131:

Let string denote the result of converting the this value to a string __using ToString__.

__If replaceValue is a not function, let newstring denote the result of converting replaceValue to a string using ToString.__

JScript 5.x converts replaceValue to a string prior to converting searchValue to a string.

V0132:

#Otherwise, let newstring denote the result of converting replaceValue to a string.# __If searchValue is not a regular expression, the result is a string value derived from the original input string by replacing each matched substring with searchString. Otherwise, the__ #The# result is a string value derived from the original input string by replacing each matched substring with a string derived from newstring by replacing characters in newstring by replacement text as specified in the following table. These $ replacements are done left-to-right, and, once such a replacement is performed, the new replacement text is not subject to further replacements. For example, "$1,$2".replace(/(\$(\d))/g, "$$1-$1$2") returns "$1-$11,$1$22". A $ in newstring that does not match any of the forms below is left as is.

__The length property of the replace method is 1 rather than 2.__