In JavaScriptException constructor do not call ScriptableObjec.toString(value) since it may potentially trigger script execution for objects defining toString method which in turn may throw exceptions.

Instead for Scriptable arguments prints their [Object className] form which is provided by the new ScriptRuntime.defaultObjectToString(Scriptable) method.

js/rhino/src/org/mozilla/javascript/JavaScriptException.java

@@ -64,7 +64,7 @@ public class JavaScriptException extends Exception
     public JavaScriptException(Object value, String sourceName, int lineNumber)
     {
         super(EvaluatorException.generateErrorMessage(
-                  ScriptRuntime.toString(value), sourceName, lineNumber));
+                toMessage(value), sourceName, lineNumber));
         this.lineNumber = lineNumber;
         this.sourceName = sourceName;
         this.value = value;
@@ -96,6 +96,15 @@ public class JavaScriptException extends Exception
         return lineNumber;
     }
 
+    private static String toMessage(Object object)
+    {
+        if (object instanceof Scriptable) {
+            // to prevent potential of evaluation and throwing more exceptions
+            return ScriptRuntime.defaultObjectToString((Scriptable)object);
+        }
+        return ScriptRuntime.toString(object);
+    }
+
     private Object value;
     private String sourceName;
     private int lineNumber;

js/rhino/src/org/mozilla/javascript/NativeObject.java

@@ -56,7 +56,7 @@ public class NativeObject extends IdScriptable
 
     public String toString()
     {
-        return NativeObjectPrototype.toString(this);
+        return ScriptRuntime.defaultObjectToString(this);
     }
 
     protected int mapNameToId(String s) { return 0; }
@@ -118,7 +118,7 @@ final class NativeObjectPrototype extends NativeObject
                     }
                     return s;
                 }
-                return toString(thisObj);
+                return ScriptRuntime.defaultObjectToString(thisObj);
             }
 
             case Id_valueOf:
@@ -167,11 +167,6 @@ final class NativeObjectPrototype extends NativeObject
         return super.execMethod(methodId, f, cx, scope, thisObj, args);
     }
 
-    static String toString(Scriptable thisObj)
-    {
-        return "[object " + thisObj.getClassName() + "]";
-    }
-
     private static String toSource(Context cx, Scriptable scope,
                                    Scriptable thisObj, Object[] args)
         throws JavaScriptException

js/rhino/src/org/mozilla/javascript/ScriptRuntime.java

@@ -544,6 +544,11 @@ public class ScriptRuntime {
         }
     }
 
+    static String defaultObjectToString(Scriptable obj)
+    {
+        return "[object " + obj.getClassName() + "]";
+    }
+
     public static String toString(Object[] args, int index) {
         return (index < args.length) ? toString(args[index]) : "undefined";
     }