var Z = "constructor";
Z[Z][Z]("alert('wtf js!')")();
// alert wtfjs!
点解?发生什么了?
Z[Z]
// function String(){[native code]}
Z[Z][Z]
// function Function(){[native code]}
解释:
Z[Z]-->string["constructor"]-->String
Z[Z][Z]-->String["constructor"]-->Function
So:
Z[Z][Z]("alert('wtf js!')")();
-->
(function Function(){alert('wtf js!')})();