Regvex is a proof of concept timing attack against regex engines. To make a long story short, the timing characteristics of regex engines make it perfectly suited to timing attacks, allowing you to (locally or remotely) create data that matches a given regex, and potentially even reconstruct the actual regex you're matching against.
The current version works locally against Python's sre, but I plan to take it further when I have time.
For others, this helped me understand the basis of timing attacks.
When you pass data into a regex engine for matching, it works character-by-character. When it reaches a character that doesn't match, the matching is terminated. That means that if you have the regex /^foo$/, "f" will take slightly longer to parse than "b", since it'll move on to the next character for "f", but not "b".
Due to this, you can produce matching data for a regex in a fairly small number of samples. Interestingly, it takes fewer samples to reliably get characters further down the string -- however, this may be a result of my horrid statistics code. Not sure yet.
As far as I'm aware, no one has ever done this before.