Cross-site scripting using .valueOf.call() — Mozilla

moz_bug_r_a4 discovered that .valueOf.call() and .valueOf.apply() when called with no arguments were returning the Object class prototype rather than the caller’s global window object. When called on a reachable property of another window this provides a hook to get around the same-origin protection, allowing an attacker to inject script into another window.