Comment #11 on issue 1274 by [email protected]: Current "virtualize" strategy isn't safe
http://code.google.com/p/google-caja/issues/detail?id=1274
Ihab, can you comment on the effect of the taming membrane on this issue? Does the host page ever get a direct reference to an ES5/3 object? If it tried to sort a "frozen" array from an ES5/3 frame, what would happen?
