I'd also like to add that __proto__ allows valid JSON to change it's object type and allow functions within properties. There isn't a compelling exploit scenerio for this yet but who knows what is possible if setters come into the equation.
alert(({"__proto__":[]}).sort)
alert(({"__proto__":function::['parent']}).location)
_______________________________________________ es-discuss mailing list [email protected] https://mail.mozilla.org/listinfo/es-discuss
