Looks good. I wonder though, if length's property descriptor is changed to configurable: false, and then an assignment is attempted, whether the replaceable algorithm will succeed? (will it remove the accessor property? Naively, I would imagine that the "setter" code would get the 'this' object (window), and then try to [[Set]] the length value on it, which would cause infinite recursion... (Perhaps this algorithm needs to be more formerly defined...)