493281-2.html
<html>
<body>
<div id="foo">
<script>
function get(x) { return x }
obj = {};
obj.__proto__ = get(document.all);
obj.foo
</script>
</div>
</body>
</html>
