> Which means that it's debatable whether making regexps callable is permitted by the spec [...]
Unfortunately (or fortunately, depending on how you look at it) it is perfectly permitted in at least ES3. See my comment on webkit's bugtracker - https://bugs.webkit.org/show_bug.cgi?id=28117#c19
I'm not fully convinced. The bit of spec you quote says that implementations can add "properties not described in this specification, and values for those properties, for objects that are described in this specification", which I take to mean that you can add properties that the spec doesn't mention, not that you can add properties that the spec does mention and doesn't say those objects have. And "internal properties" are not really properties, which makes it even less clear that that language gives licence for an implementation to add them to objects they aren't specified for.
(I do still think the spec should be interpreted as making regexps callable, but only because it doesn't explicitly say that implementations aren't allowed to decide for themselves about internal properties whose existence and/or value is left unspecified in the spec.)
Yes, there's clearly an ambiguity in section 2 with regards to internal properties.
Looking at "Internal Properties and Methods" section (8.6.2), you can see that specification makes it pretty clear that, for example, host objects' behavior is completely implementation-dependent: host objects are allowed to "spoof" [[Class]] values (which they, in fact, do in real life); that [[DefaultValue]] can go as far as throwing an error; that [[Get]], [[Put]] and [[HasProperty]] do not have to necessarily match; and that they don't have to implement any or all of the internal methods at all.
But that's host objects, and we are talking about built-ins, so there's no proof there.
I guess my point is that specs usually tend to state important things explicitly (using somewhat unambiguous keywords like "must" or "should"). You can see it in that same 8.6.2 section:
| Every object (including host objects) must implement the
| [[Prototype]] and [[Class]] properties and the [[Get]],
| [[Put]], [[CanPut]], [[HasProperty]], [[Delete]], and
| [[DefaultValue]] methods.
Might be worth bringing this up on es-discuss/es5-discuss mailing lists.
Unfortunately (or fortunately, depending on how you look at it) it is perfectly permitted in at least ES3. See my comment on webkit's bugtracker - https://bugs.webkit.org/show_bug.cgi?id=28117#c19