Array.prototype.map.call({length: -1, get 0(){throw 0}}, function(){}).length

should throw error ("0") when trying to read first element of array rather than evaluating to a length value.