Answer: k is at most 20 (since the implementation I use stores the mantissa as an unsigned 64 bit integer, and the length of the decimal representation of the largest one of those is 20.
Thus the maximum length is indeed 25. The other cases have lower bounds (and I don't expect anybody else to care about this at all, so i won't write about them...).
So by choosing to begin printing small numbers in scientific notation at 6 leading zeros rather than 5, the ECMAScript team made it necessary to use a buffer of 25 bytes rather than the much more natural 24 bytes =/