Error objects are ordinary objects; the only thing in the spec that distinguishes them from others ordinary objects, is an internal [[ErrorData]] property, whose only use is to flag them for Object.prototype.toString (cf. bug 3816).
One could get rid of [[ErrorData]] and have Error.prototype[@@toStringTag] = "Error" instead. A consequence of that change, is that Error.prototype and objects inherited from it will be tagged as [object Error] by O.p.toString. That doesn't seem dangerous, because AFAICS, Error instances have no method that would choke on non-Error objects.
the final ES6 changes WRT O.p.toString and @@toStringTag were made at the Jan 2015 TC39 meeting https://github.com/tc39/tc39-notes/blob/master/es6/2015-01/jan-28.md#45-tostringtag
However, this looks like a change that could be made in a future edition so I'm marking this one as deferred to ES7