Because Torbutton overrides the 'window.history' object in JavaScript, the builtin XPCNativeWrapper (retrieved from the global object '__proto__') can be used to retrieve the native 'window' object and read the original values.