`freeze` and `keys` are properties of `Object`, not `Object.prototype`. The only problematic properties (that I know of) are `__proto__` and `hasOwnProperty`.
Scratch that, there's a lot more:
```js
> Object.getOwnPropertyNames(Object.prototype)
["__proto__", "constructor", "toString", "toLocaleString", "valueOf", "hasOwnProperty", "isPrototypeOf", "propertyIsEnumerable", "__defineGetter__", "__lookupGetter__", "__defineSetter__", "__lookupSetter__"]
```
`Object.create(null)` has none of those, *however*, make sure you **never** set `__proto__` (it doesn't do strange things from what I can tell in DevTools, but it may cause problems in other engines. well, it could be perfectly fine, but I felt the need to share this little thing).