The HTML engine probably has an internal list of ids to quickly look them up. The dev tools, however, access it externally. It's quite likely they simple use `t

The HTML engine probably has an internal list of ids to quickly look them up. The dev tools, however, access it externally. It's quite likely they simple use `treeNode->getId()` without being aware that this call respects JS overwrites. It might even be a feature; the C# debugger, for example, will call your custom `toString()` function in order to give a nice representation in the debug window. The problem here is, of course, that the debugger is running against untrusted code.