Execution of unrelated Object.prototype methods by TeX parser

Created by: sergey-o

When given the TeX input \toString, MathJax internally calls Object.prototype.toString as a control sequence "handler" instead of reporting an error. This happens for any property name defined in Object.prototype and is caused by missing hasOwnProperty checks in lookups (here, for instance).

Examples of other problematic constructs: \begin{toString}\end{toString}, \cfrac[toString]ab.