Agreed, regular expressions are not turing complete and they can still make your browser ponder for a bit if carefully crafted. Try

  /(x+x+)+y/.test('xxxxxxxxxxxxxxxxxxxxxxxxxxxxx')

for instance. This regex doesn't even use non-regular extensions; it's expressible in a very limited computational model, it fits in a tweet and yet it renders my browser unresponsive.

I can do even more damage with a nasty shader; GLSL is not turing complete either (in fact it looks a lot like Crema).