sed depends on -r to be rightmost flag to simplify the REG_EXTENDED test. (If a flag is 1, you can multiply it by the value you want and get that value else zero without a branch or conditional assignment.) So move -E one to the left so FLAG_r is 1 again, and add a [+Er] suffix instead of testing FLAG_r | FLAG_E in the users.

#!/bin/bash

# Quick and dirty check to see if anybody's leaked global variables.
# We should have this, toy_list, toybuf, and toys.

nm toybox_unstripped | grep '[0-9A-Fa-f]* [BCDGRS]' | cut -d ' ' -f 3