Comment #3 on issue 1283 by metaweta: Constructed objects don't get their constructor property whitelisted.
http://code.google.com/p/google-caja/issues/detail?id=1283
It's this aspect that 1283 is trying to fix:
(new f).constructor === f
trueIf f.new___ === f, there's no place to stand to whitelist the constructor property on the resulting object. Instead, I've effectively whitelisted constructor for reading on all objects.
