1 2 3 4 5
o0=r=/x/; this.toString=(function() { evaluate("",({ element:o0 })); }) oomTest(String.prototype.charCodeAt,{ keepFailing:true })