1 2 3 4 5 6 7 8
try { __defineGetter__("eval", function() { this["__proto__"] }) delete this["__proto__"] this["__proto__"] } catch (e) {} eval