Feeding this script to ToT Release/testkjs makes it crash. this.__proto__ = 1; r = 2;
<rdar://problem/5806428>
Fixed in r31145.
Reopening this since it still happens.
Committed revision 34160.