title: JavaScript security issue
body: <p>I wanna know how the following function set 'this' element and fetch the array cell out? please.</p>
  
  <p><div class="snippet" data-lang="js" data-hide="false" data-console="true" data-babel="false">
  <div class="snippet-code">
  <pre class="snippet-code-js lang-js prettyprint-override"><code>//my secure code
  var priv = ['item-0','item-1'];
  var api = {push: function(x){priv.push(x)}}
  
  api.store = function(i,x){priv[i] = x}
  
  //the attaker script
  var result;
  api.store('push',function(){result = this[0]});
  api.push();
  
  //the result is cell 0 of private array
  //how?
  //if i change the 'push' parameter then the result is empty!
  document.write(result)</code></pre>
  </div>
  </div>
  </p>