Great read, and nice-follow up to the array.reverse() exploit from last year which I hadn't ever seen fully explained.