Non-AlphaNumerical Script Part 2

So I have learn some additional things regarding non-alpha numerical script.

Additional ways to run a script expressed as a string.

eval("expression");
Function("expression")();
setTimeout("expression",x);
setInterval("expression",x);

//0.constructor == Number()
//0.constructor.constructor == Function()

From previous blog,
+[] == 0 // /unary + tries to convert its operand to number
~[] == -1 (bitwise not with any non-numerical value == -1)
((+[])["constructor"]["constructor"])("expression")();
The "constructor" string can be created through the usage of strings from "true", "false", and etc.  Such as ![]+"" == false, and etc.

Another thing I learned is that the Array.prototype.sort() returns and window object.  So one can form an alert through something similar:

a = [], b = a["sort"], c = b(); // window object
d = c["alert"], d("string");

Other things I didn't know, not related to Alpha-Numerical Javascript, but against filters.
Some XSS filter prevents single and double quotes. 

1. Refer to an external script
2. Use String.fromCharCode();
3. alert(this.attribute_in_an_element)
4. forward slash regex syntax: /x/.source


Additional things I didn't know:

["x","y"].sort(alert);  ["x","y"].sort(confirm) will display alert and prompt with the value "x".