accept -d flags on the command line, bumping up debug_level for each instance
accept either 1 or 2 args.  if 2 args, it's (level_required, msg).  if 1 arg, it's (msg)
return an atom instead of a new empty string, and move the EJSVAL_TO_FLAT_STRING out of the memmove
copy the right number of characters, and allocate the proper size buffer in String.prototype.replace
implement the sanitize_with_replace codepath as a loop instead of a one-shot (which is what string.prototype.replace does) to make it act like the regexp form.  also debug.level == 1 => print tree out before/after closure conversion
ignore ejs.js.exe.stage1 and .stage2
no need to reuse the node.  just create a new identifier
reorder ToString a touch, and fallback to Object.prototype.toString() as a worst case for debugging
make property iterators actual JS objects so they will keep the keys alive if a GC happens while we're iterating.  fixes tons of crashes.
add a property desc for array.length, and lots of fixes for Array.prototype.splice.
add a test with both args supplied
add compare-% target that diffs the llvm ir from stage0 and stage1
more switch tests
add concatenated versions of each test so we can run them through node
add a test that mimics the shallowCopy method in nodevisitor