Given the limitations of the Javascript regex variant (not just the lack of lookbehinds that Mash mentioned, but also the lack of atomic groups), a possible way would be to use:
\#(x?[\da-f]+;|(\w+))
(you may not need the '\' before the '#' as the Javascript regex doesn't support comments either and so may well not treat the '#' as the start of a comment) and then look to see if anything is captured in match group #2: if there is something then it is your "hashtag" (assuming '\w+' will match any possible hashtag - I have no idea so you may need to modify this bit) and if not then it was a character encoding.
Based on this, you can decide if you want to process the match (using the location and length information in the match object) or skip over it.
By the way, I've not fully tested this but that part of the pattern should handle both decimal and hexadecimal encoded characters.
Susan