	regExDate: function (str, p1, p2, offset, s) {
		var date = str.substring(1).replace('"', '');
		if (date.substring(0, 7) == "\\\/Date(") {
			var d = date.match(/Date\((.*?)\)/)[1];
			return "new Date(" + parseInt(d) + ")";
		}
		else { // ISO Date 2007-12-31T23:59:59Z                                     
			var matches = date.split(/[-,:,T,Z]/);
			if (matches.length == 7) {
				matches[1] = (parseInt(matches[1], 0) - 1).toString();
				var isDate = true;
				var s = "";
				for (var i = 0; i < matches.length; i++) {
					if (isNaN(parseInt(matches[i], 10))) {
						isDate = false;
						break;
					}
					if (i > 0) {
						s += ",";
                    }
					s += parseInt(matches[i], 10);
				}
				if (isDate) {
					return "new Date(Date.UTC(" + s + "))";
				}
			}
		}
		return str;
	},

The application deserializes untrusted data without sufficiently verifying that the resulting data will be valid.