Javascript objects can be overwritten though, can't they? A malicious user if they succeed in getting their code into the same context just has to make sure it runs after window.sandbox is initialized, and replace that with, say, null, and then do whatever they want.