Test a JavaScript regular expression against real text, see every match highlighted in place, and read the capture groups out one by one.
JavaScript's own, run by your browser. That matters: lookbehind, named groups and unicode property escapes are all here, and PCRE features such as recursion are not.
Because the listing shows every match. Without it the engine returns the first one forever, which looks like a broken page. Your own flags are still shown and used for everything else.
Reading the result without counting brackets. (?<user>...) gives you match.groups.user, which survives someone adding a group in front of it later.
Almost always catastrophic backtracking: a quantifier inside a quantifier, such as (a+)+ or (\w+\s*)*, against a string that nearly matches. The engine tries every split before giving up. Make the inner part specific, or anchor it, and never run a user-supplied pattern on a server.
The s flag makes a dot match a newline; the m flag changes what ^ and $ mean, so they anchor to each line rather than the whole string. They are unrelated, and reaching for m when you meant s is the most common regex bug there is.