coope/lst/ctor-factory-priv-exploit.js

var Database = Class(
{
    // ...

    forEachRow: function( callback )
    {
        for ( row in this._rows )
        {
            callback( row );
        }
    },

    _getPassword: function()
    {
        return 'secret';
    }
);

var db     = Database( '...' ),
    passwd = '';

// ...
db.forEachRow( function( row )
{
    passwd = db.__priv._getPassword();
} );

// oops
unauthorizedDbOperation( 'user', passwd );