No, there is actually no exploit here. The hasOwnProperty check is stricter, so it will never incorrectly return a function. And, as the lifespan of the object is contained within this function, no external uses will accidentally call toString on the object. You are safe here :)