Consider the following code:

{
	'template-string-pattern': /`(?:\\[\s\S]|\${[^}]+}|[^\\`])*`/,
	'a': 0,
	'b': 1
};
{
	'string' : /(`|')(?:\\.|(?!\1)[^\\\r\n])*\1/m,
	'c': 0
};

Highlighted using Test Drive:

What's happening is quite simple:

1. template-string matches (?:\\[\s\S]|\${[^}]+}|[^\\ and /, 'a': 0 ....... 'string': /( (plus the grave accents).
2. string matches 'template-string-pattern' and 'c'. The rest is blocked by template-string.
3. regex breaks the matches of template-string and highlights the regexes.
4. string gets a chance from regex to match and does so matching 'a'. But that's it, because oneshot=true.

Btw: You can see this bug all over the place when you look at the Prism code with lots of language definitions.