<!DOCTYPE html> <html> <head> <script type="text/javascript"> function boom() { ({})[document.createElement('unsupported').tagName]; uneval(Components.interfaces.nsIWebNavigationInfo); } </script> </head> <body onload="boom();"></body> </html>