> uneval(new DOMException("#", "%")) (new %("#", "", 1)) Why is the second argument being treated as if it's a constructor name?

> Why is the second argument being treated as if it's a constructor name? new DOMException(x, y) creates a DOMException with .message == x and .name == y. uneval does toSource. DOMException has Error.prototype on its prototype chain. So we end up invoking Error.prototype.toSource on this DOMException. Which leads us to a simple way to reproduce this problem without DOMException: uneval(Object.create(Error.prototype, { name: { value: "%" } })) So what's happening is that Error.prototype.toSource (exn_toSource) never checks for thisval being an Error and just happily gets its .name, .message, .fileName, etc and produces a string from all that.

Or heck, here's another simple example: var e = new Error(); e.name = "%"; uneval(e)