Found this page on the web:
http://blogs.msdn.com/jscript/archive/2007/10/29/ecmascript-3-and-beyond.aspx
Quote:
"[...]Did you know that Custom properties that shadow [[DontEnum]]
properties on Object.prototype are not enumerated using for-in in IE?[...]"
This is the problem. In IE6, 'toString' will not be enumerated, even
if it is an explicit property in an Object:
lzx> for (var k in {foo: 1, toSTring: 2}) Debug.write(k)
foo
toSTring
lzx> for (var k in {foo: 1, toString: 2}) Debug.write(k)
foo
lzx>
