In the original it was not just private but totally inaccessible within the format method itself:

http://yuilibrary.com/yui/docs/api/files/date_js_date-format.js.html#l281

So I put it as private when making it shared.  

However, you have a point here.  Should the aggregates hash change, which is public (don't know why, but that's how it was) and might well be modified, the regexp inside this method would not change and any additions would be ignored.

I would actually make the aggregates hash protected, but that means changing Y.Date.format beyond what is needed for this patch, and keep this private since the hash already provides all the required flexibility.