d0nut: Great post! First post I found mentioning this issue.

However, I’m finding that both of the following do work:

delete Object.getPrototypeOf(function*(){}).constructor;

and

Object.defineProperty(
  Object.getPrototypeOf(function*(){}),
  'constructor',
  { value: null });

Ditto for AsyncFunction (aka Object.prototypeOf(async function(){}).constructor).

Combined with ES5 Strict Mode (so that getting the global object isn’t as easy as (function(){return this}())), as far as I know this should fully prevent access to the global scope, right?

(As I mention in another comment, I agree with your overarching point that iframes and workers are much safer, but I think this is still valuable for defense-in-depth — plus, it’s fun!)