Bugfix: replace hash should not append hash mark to javascript:0

It's invalid to do so. Instead it should replace the entire URL,
javascript:0 included.

This gets rid of a javascript error that was emitted in IE7 every time
navigate was used with replace: true

backbone.js

@@ -853,7 +853,7 @@
     // a new one to the browser history.
     _updateHash: function(location, fragment, replace) {
       if (replace) {
-        location.replace(location.toString().replace(/#.*$/, '') + '#' + fragment);
+        location.replace(location.toString().replace(/(javascript:|#).*$/, "") + "#" + fragment);
       } else {
         location.hash = fragment;
       }