NativeRegExp still uses the slow ScriptRuntime.apply() to invoke a callback in callReplaceValue. We changed all other instances of this to use a dynamic invoker on a "dyn:call" object, e.g. see getEVERY_CALLBACK_INVOKER() in NativeArray etc.

This is one accidental remnant of such behavior, and should be consolidated.