src/third_party/mozjs-45/js/src/jit-test/tests/basic/bug709634.js

Function.prototype.toString = function () f(this, true);
function f(obj) {
  f.caller.p
}
decodeURI + 3;