5.4.11. Trick

5.4.11.1. Constructing specific characters from regular expressions

empty = RegExp.prototype.flags
regSource = { ...RegExp.prototype.source }
regSource.toString = Array.prototype.shift
regSource.length = 4
left  = regSource + empty // generate (
quest = regSource + empty // generate ?
colon = regSource + empty // generate :
right = regSource + empty // generate )

xss = {}
xss.source = 'xss'
xss.flags = 'a'
xss.toString = RegExp.prototype.toString
xss + "" // => /xss/a