Nice trick!

  var f = []['concat']; // Array.prototype.concat
  f()[0]; // returns the global window

The rest of the script appears to mostly be old tricks - convert stuff to strings, combine characters in strings to compose expressions, pass them to eval...