tl;dr: A novel JavaScript technique for invoking arbitrary functions without parentheses by overwriting `Error.prepareStackTrace` with the `Function` constructor, which shares a compatible signature. Since accessing an error's `stack` triggers this callback with an array of code positions, the author manipulates `Array.prototype.toString` (via direct override or prototype pollution of `Object.prototype.message`) to inject valid JS code. The generated function is then triggered using the `valueOf` trick by coercing the error object to a primitive.