<html>
    <body>
        <div id="foo">
            <script>
                function get(x) { return x }
                obj = {};
                obj.__proto__ = get(document.all);
                obj.foo
            </script>
        </div>
    </body>
</html>
