src/third_party/mozjs-45/js/src/jit-test/tests/basic/bug645632.js

function f(o) {
    o[{}] = 1;
    with(Object) {}
}
f(Object.prototype);