Logged In: NO

I concur with the bug identification--I wish that I
checked for this bug being posted before I debugged it
myself. The function must return a node (or null), not a
String (the result of replace()).

As for the recommended fix, it looks good to me but I
don't know the language/DOM very well. I take it that
textNode.nodeValue.replace() both modifies
textNode.nodeValue and returns textNode.nodeValue. I don't
like that dual behaviour but if it is so then the fix
should work.