jsfuck | Write any JavaScript with 6 Characters : ! + | Runtime Evironment library

The function constructor takes more than one argument:

Yes, it is possible.

So we start with the expression that omits the comma, and only consists of string literals and the JSF characters:

The existing technique to wrap the subject of the method inside an array, which is mentioned here, was intended specifically for strings, turning "string" into ["string"]. The trick was using .split() without arguments. After applying that trick, it was not so difficult to use the other little tricks to apply the method that was desired, and allow chaining on the result.

Of course, now that the subject is an array, we cannot use .split().

It turns out that you can use the following method to make it happen for arrays:

Question 2 has a simple solution: prefer the new RegExp constructor; e.g. /e/g becomes new RegExp('e', 'g');

The following would resolve question 1 if it didn't rely on the ... operator:

We can replace:

I don't see a way to get access to the RegExp constructor without evaluating code, like with the Function constructor: