Visit stackoverflow.com/#_=_
and window.location.hash
evaluates to #_=_
. Fine.
Now execute window.location.hash = \'\'>
Answering to your first question:
According to the window.location doc in Mozilla.org: "the part of the URL that follows the # symbol, if there is one, including the # symbol. Empty string if the url does not contain # or has nothing after the #."
Curiously, that document was just updated on 4/8/2013. Not sure if that was added after you checked the documentation.
By the way (and in reference to the answers), the window.location.hash and pushState are different concepts although close related.