Bug in XPath Engine of Safari 3.0

The pipe "|" operator after Predicate is ignored.

Example:

// 2
alert(
  document.evaluate(
    '//body | //head', document, null, 7, null).snapshotLength
);

// expected 2 but actually 1
alert(
  document.evaluate(
    '//body[.] | //head', document, null, 7, null).snapshotLength
);

The "string-after" function gets wrong string.

Example:

// expected "d" actually "cd"
alert(
  document.evaluate(
    'substring-after("abcd","bc")', document, null, 2, null).stringValue
);