<!DOCTYPE html> <html> <head> <script> function boom() { window.__proto__ = function(){}; for (var i = 0; i < 10000; ++i) { self.document; } } </script></head> <body onload="boom();"></body> </html>