alert(1) to win

The code below generates HTML in an unsafe way. Prove it by calling alert(1).

function escape(s) {
  // Bonus level because StackOverflow

  Object.defineProperty(console, 'foo', 
     { get : function() { throw 'nooo!' } });

  var code = 'with((window.console && console.foo) || {}) {\n\t'+s+'\n}';
  console.log(code);

  try {
    console.log(eval(code));
  } catch (e) {
    console.log(e);
  }
}
Input
Result

HTML source code


    

Rendered iframe

The code should run without user interaction.

Log output


  
Here be spoilers