Yesterday we've been bitten by #1525. After an upgrade to 2.8.4, we still got issues with for loop related code.

I boiled it down to this (kind of minimal) example:

$ echo "'use strict'; var id = ''; for (id in {break: 'me'}) { console.log(id) }" | node_modules/uglify-js/bin/uglifyjs --compress --mangle
WARN: Replacing constant id [-:1,67]
"use strict";for(id in{break:"me"})console.log("");

Which not even produces semantically wrong code, but also code that will produce a runtime error in the browser (due to use strict) about the variable id not being defined.

I also played around a little more and found another obviously broken case:

$ echo "'use strict'; var id = ''; for (var id in {break: 'me'}) { console.log(id) }; console.log(id);" | node_modules/uglify-js/bin/uglifyjs --compress --mangle
"use strict";var id="";for(var id in{break:"me"})console.log("");console.log("");

Besides this from being bad style (because of the same variable is declared twice), the result is still wrong.