mozilla -- javascript "lambda" replace exposes memory contents

A Mozilla Foundation Security Advisory reports:

A bug in javascript’s regular expression string
replacement when using an anonymous function as the
replacement argument allows a malicious script to capture
blocks of memory allocated to the browser. A web site
could capture data and transmit it to a server without
user interaction or knowledge.
Workaround: Disable Javascript