code var foo, bar, buz = 'javascript:alert("Hello, World!")' ; for (foo in {}.valueOf.call()){ if (foo.split('o')[0] === 'l'){ ({}.valueOf.call())[foo.split('bar')[0]] = buz; } } // works on IE6, Firefox1.5.0.8, Opera9.02, etc Why does it works on IE6? //Because of ... /* Original code is provided by Gareth Heyes */ Object.prototype.valueOf.call() == window //this is true on IE6, Firefox1.5.0.8 ,

