Flat string matching is used for str_search, str_match, and str_replace to avoid costly regexp paths (also StringMatch is getting pretty fast (bug 558270)). I wimped out on doing flat matching for regexps that don't contain meta-chars precisely because of all the RegExp static field gunk required to not break it. With them gone, it would be fairly easy to do.
I think this is a WONTFIX -- we can't change this without breaking the web, unless some ES opt-in de jure says that these no longer exist.
Any page on the Web that uses RegExp.$1...$9 is already skating on thin ice, as discussed in bug 437101 and bug 320811, because extensions may modify the values before they're used. (Unless bug 571355 addresses that problem; that bug is way beyond me.) Is there some mechanism that could be used to warn developers of the dangers of using RegExp.$1...$9, perhaps when they're running under a debugger?