@@toStringTag spoofing for null and undefined

[Boris Zbarsky]

On 1/20/15 3:13 PM, Jordan Harband wrote:
> Between the two issues I proposed, I definitely think that "something
> pretending to be a builtin" is far less hazardous then "altering
> builtins to appear to be something else". If removing the prefixing
> entirely is what it takes to make *all* (not just ES5) builtin
> @@toStringTag values non-configurable, I'd be happy with that.

I don't see how that solves the problem you're trying to solve.

Consider:

   var arr = [];
   Object.defineProperty(arr, Symbol.toStringTag,
                         { value: "Date" });

In today's spec, Object.prototype.toString.call(arr) will be "[object 
~Map]".

If the ~-prefixing is removed, this will return "[object Date]", no? 
The fact that @@toStringTag is non-configurable on Array.prototype 
doesn't matter, since the above code shadows it on the instance.

-Boris