The example on this page covers it:
http://blogs.msdn.com/jscript/archive/2007/10/29/ecmascript-3-and-beyond.aspx
Here's the same test in html:
<html>
<body>
<script>
var hash = {foo: 1, toString: 2};
for (var k in hash) document.write("<br/>name: ", k);
//
http://blogs.msdn.com/jscript/archive/2007/10/29/ecmascript-3-and-beyond.aspx
var res = hash.propertyIsEnumerable("toString");
document.write("<br/>hash.propertyIsEnumerable(\"toString\"): ", res);
</script>
</body>
</html>
This is the problem. In IE6, 'toString' will not be enumerated, even
if it is an explicit property in an Object:
lzx> for (var k in {foo: 1, toSTring: 2}) Debug.write(k)
foo
toSTring
lzx> for (var k in {foo: 1, toString: 2}) Debug.write(k)
foo
lzx>
