The JSONTokener object can have references to large objects like i/o buffers. And it's not really used after JSONObject/JSONArray constructor finishes. At least references to JSONTokener (and JSONParserConfiguration) can be nulled at the end of constructor.

Or you can introduce constructor like this:
private JSONObject(JSONTokener x, JSONParserConfiguration jsonParserConfiguration, boolean requireInputEnd)
that checks for the absense of trailing chars (by the way this check is duplicated in JSONObject(String source) constructor since it delegates to another constructor which checks for the same thing). This new constructor could use JSONTokener/JSONParserConfiguration without introducing fields.