The object structure of NativeError (19.5.6, http://www.ecma-international.org/ecma-262/6.0/#sec-nativeerror-object-structure) indicates the message property of the prototype object is an implementation dependent string in the introduction of this section: “Each of these objects has the structure described below, differing only in the name used as the constructor name instead of NativeError, in the name property of the prototype object, and in the implementation-defined message property of the prototype object.”
The detailed specification, however, specifies it to be the empty string (19.5.6.3.2, http://www.ecma-international.org/ecma-262/6.0/#sec-nativeerror.prototype.message): “The initial value of the message property of the prototype for a given NativeError constructor is the empty String.”