src/third_party/mozjs-45/js/src/jit-test/tests/basic/bug700501.js

Function.prototype.__proto__["p"] = 3
c = [].__proto__
c[5] = 3
gc()
Function("\
    {\
    function f(d) {}\
    for each(let z in[0]) {\
        f(z)\
    }\
    }\
")()