You're right on the `keys` and `freeze` thing.

`Object.prototype` has a lot more properties than I thought.

----

I'm definitely going to try to set `Object.prototype.__proto__` on every different JS engine I happen to encounter.

----

`Object.prototype` is a serious hole in the language; these should have all been functions of `Object` -- with something like `protoSet` and `protoGet` to replace `__proto__`.

I guess `Object.create(null)` is the workaround.

----

The main thing I was worried about was someone either purposely or accidentally doing `Object.prototype['--property'] = ...`. That's the only thing that would affect the current code. So it's definitely a paranoia thing, as arv said.

```js
// Or even more maliciously
Object.defineProperty(Object.prototype, '--property', {
  get: function() { console.log('arbitrary code'); },
  enumerable : false,
  configurable : false,
})
var o = {};
var oProperty = o['--property'];
```

Someone would basically have a command-line option to take control of the application.