Bypass with Object.prototype pollution 

```
Object.defineProperty(Object.prototype, 'haha', {
    enumerable: true,
    value: undefined
});

var f = document.createElement('iframe');
try {
    document.head.appendChild(f);
} catch (e) {}
f.contentWindow.alert(1);
```
Should use the `Object` from `natives` and `Object.create(null)`...