Missed vulns

[davisjam]

Detectors miss:

1. /a+$/ is vulnerable but detectors miss it.
2. /a{1,100}a{1,100}a{1,100}$/ is vulnerable but detectors time out.