That is a side channel.

```js
var obj = Object.freeze(...);
untrustedPartyA(obj);
untrustedPartyB(obj);
```

If we keep hashObj mutable, A and B can now use it to communicate.