Reported by Walter Higgins on nashorn-dev:

http://mail.openjdk.java.net/pipermail/nashorn-dev/2014-February/002745.html

The problem is that the global variable is configurable but callsites using it will not be properly guarded.

Script to reproduce:

global = this;

function test() {
  global.self = 123;
  try  {
    print(self);
  } finally {
    delete global.self;
  }
}

test();
test();
test();