grep supports regular expressions as well (hence it's name: http://en.wikipedia.org/wiki/Grep). In fact GNU grep even has support for PCRE.

However it should be noted that regex isn't the right tool for parsing source code to begin with. There could be instances in that code where false positives are matched. And there are already known instances where positives are missed (namely "//" comments). So if you really want to exclude anything that isn't a comment then the only accurate way to do so would be full source code parsing. Failing that, it's better to match all instances since "TODO" generally isn't a string that occurs frequently outside of comments (unless it's a visual prompt to the user, eg

  alert('TODO: this feature hasn't been implemented yet')

but in those instances you'd want the source code captured as well).