See section 2, paragraph 2: http://www.ietf.org/rfc/rfc4627.txt?number=4627
See section 2, paragraph 2: http://www.ietf.org/rfc/rfc4627.txt?number=4627
The particular issue is that the spec refers to "JSON text" (which no one ever uses in practice) as well as "JSON value" which is what everyone expects. The difference being that a "JSON value" is any of the 'bare' types (null, boolean, number, string, object, or array). A quick survey of JSON parsers will show you that most will accept any of these types at the top level. The one notable exception I'm aware of is Ruby's JSON library (the default one? I'm not so hip to the Ruby).
Notably, though, is that the major JavaScript interpreters don't enforce this constraint (Nor do Python or YAJL (kinda) or Erlang (even the ones I didn't write)).
Don't bother asking me about invalid combining characters as \u escapes. You wouldn't like me when I get the rage eyes.