Here's the breakdown: []["sort"]["call"]()["eval"] is the same in javascript as ([].sort.call()).eval The part in parentheses calls Array.sort with an u

Here's the breakdown: []["sort"]["call"]()["eval"] is the same in javascript as ([].sort.call()).eval The part in parentheses calls Array.sort with an undefined this object, defaulting it to window. Array.sort returns this after it's done. Global functions like eval are stored on window, so you end up with window.eval.