Well at least in Firefox, JavaScript native objects return function Object() { [native code] }, which has ‘v’. So if we have window and Object, then i suppose we could do:
(window["Object"]+0)[29];
Well at least in Firefox, JavaScript native objects return function Object() { [native code] }, which has ‘v’. So if we have window and Object, then i suppose we could do:
(window["Object"]+0)[29];