On Nov 4, 2011, at 10:33 AM, Axel Rauschmayer wrote: > How about: > > function Bob(t) { > var stolenArray; > var hackedPush = function() { > stolenArray = this; > }; > t.store("push", hackedPush); If Array.prototype has been frozen (as the problem statement implied) then the above line should throw. Allen