[2.2.1] adds function constructor with malisious code.