For "xxxx", "x*" matches the null width "beginning" then matches all the "x"s to the end.

Well, that would mean the first result would be 1, not 2. What happens is that /x*/ matches the zero-length string at the beginning, all the x-es, but not the zero-length string at the end. After the first substitution, the regex hasn't reached the end of the string yet, so /g kicks in. All that's left is the zero-width string at the end - this is now matched (were it wasn't before), and hence we get a second substitution, resulting in a result of 2 and a final "##" string.

Frankly, I find this behaviour unexpected and unwanted. I'd call it a bug, but I bet someone once had a use for this, and now that's the way it goes.

Abigail