Because Torbutton overrides the 'window.history' object in JavaScript, the builtin XPCNativeWrapper can be used to retrieve the native 'window' object and read the original values. A reference to the original XPCNativeWrapper function can retrieved by creating an iframe with a javascript: URL source that saves the function, but returns no content.