michael@0: 
michael@0: Array.prototype.__proto__ = Function.prototype;
michael@0: var x = [1,2,3];
michael@0: x[0];
michael@0: 
michael@0: [].__proto__.foo = true;
michael@0: eval("[]");