The statefulness of the combination of the g flag and .exec() cost me several hours a couple of months ago on a necessary upgrade, finding something deep inside a router that had been fine with /g before but which had after changes made the implicit assumption that .exec() was idempotent. Having it work every second time was a little annoying.
I cannot recall the details, but the two were not in close proximity—the exec() was in a different module which was being called from another location with a regular expression from a third location. The /g had never been necessary, as the expression was ^$-bounded; I presume that the person who originally wrote it didn’t know what /g was but had seen it on some other regular expressions about the place (occasionally, just occasionally, reasonably).
http://stackoverflow.com/questions/1520800/why-regexp-with-g...