As I understand, there's no limit to what you can do with these six characters.

It quickly gets more complicated though, and will require alot more code:

"undefined": [][![]]+[] (empty array accessed at index 0 turned into string)

"NaN": +{}

"[object Object][object Object]": {}+{}

.. etc

See the full list here:

https://github.com/aemkei/jsfuck/blob/master/jsfuck.js