@karmagination Great tip! Interestingly enough, this also works for String and Function (and probably other native objects, too):

String = function(){ return 'Hijacked string object!'; };
String({});
//=> 'Hijacked string object!'
String = ''.constructor;
String({});
//=> '[object Object]'

Function = function(){ return function(){}; };
Function('arg', 'return arg;');
//=> function(){}
Function = (function(){}).constructor;
Function('arg', 'return arg;');
//=> function anonymous(arg){ return arg; }