LayoutTests/fast/dom/Window/window-custom-prototype-crash.html

<script>
    if (window.testRunner)
        testRunner.dumpAsText();

    var newPrototype = new Object();
    newPrototype.myNewPrototypeFunction = function() { return "myNewPrototypeFunction"; }
    window.__proto__ = newPrototype;
    window.myNewPrototypeFunction();
</script>
If this did not crash the test has succeeded.