Nice trick!<p><pre><code> var f = []['concat']; // Array.prototype.concat
f()[0]; // returns the global window
</code></pre>
The rest of the script appears to mostly be old tricks - convert stuff to strings, combine characters in strings to compose expressions, pass them to eval...