Not exploitable. A DOS at best.
Created attachment 406282 [details] [diff] [review] patch This currently depends on 522195 to apply cleanly (522195 added another case with the same bug, extending the existing code, this patch fixes both).
for (var i = 2; i < 40; ++i) (5).toString(i); whale:src gal$ ./Darwin_DBG.OBJ/js -j x.js x.js:2: Error: illegal radix 37 whale:src gal$
With trace-test addition of course. /be