Fix bug 697141: buffer overrun in regexp string substitution.
Fix bug 697141: buffer overrun in regexp string substitution.

A '$' escape at the end of the string would read past the zero terminator
when looking for the escaped character.

ccxvii/mujs,ccxvii/mujs,ccxvii/mujs,ccxvii/mujs