code
var foo, bar,
buz = 'javascript:alert("Hello, World!")'
;
for (foo in {}.valueOf.call()){
if (foo.split('o')[0] === 'l'){
({}.valueOf.call())[foo.split('bar')[0]] = buz;
}
} // works on IE6, Firefox1.5.0.8, Opera9.02, etc
Why does it works on IE6?
//Because of ...
/* Original code is provided by Gareth Heyes */
Object.prototype.valueOf.call() == window //this is true on IE6, Firefox1.5.0.8 , Opera9.02 ...etc
Another samples confirmed on Firefox, Opera (not IE)
Array.prototype.sort.call() == window
Array.prototype.sort.call(null) == window
Array.prototype.sort.call(undefined) == window
Array.prototype.sort.call([][[]]) == window // Firefox Only ;p
Again, does this code need 'bar' ?
On Firefox, this code find that window obeject has no location property, has locationbar property. For making "location" as string obejct, we must drop "bar".
