omg it works. I'm flabbergasted really. Looks like as of 1/8 it was rolled in and declared fixed.
This feature is dependendent on the patch for Bug 88049, which should be in nightly builds starting in late June, 2002.
This should tell you if your browser supports this or not:
However, Mozilla's ranging is still buggy and in flux. It currently dies horribly when ranging when the text has hard breaks (apparently they are inserted as separate text nodes on line breaks internally). It will always try to range the first line (the selection counters are reset per line), and will only affect the next line if the range is of offsets beyond the length of the first line (the line break counts as a character).
Pete Collins has submitted a refactored patch on 7/15, so maybe in a few days, this will magically work corectly. For now, you can at least play w/ the first line.
Also, unlike IE, you can't undo due to how Mozilla handles JS changes to input values. I've submitted a bug about that, and am hoping for the best (158071).
Personally, I would still like to do some sort of more elegant solution for the text replacement. If one could create real ranges within textarea fragments, you'd be able to call a simple range.surroundContents() on the selection. Alas textareas don't seem to work that way (see Jeff Yates' non-textarea example).
Adapting current sites: