diff --git a/CHANGELOG b/CHANGELOG
index 479781c7f..57cb79cd9 100644
--- a/CHANGELOG
+++ b/CHANGELOG
@@ -1,3 +1,5 @@
+* . Use `in` operator when accessing property of a nodelist to prevent Safari <=2.0.4 from crashing (kangax)
+
 * Add Element#clone as a safe wrapper of native `cloneNode`. (Andrew Dupont, kangax)
 
 * Add tests to ensure IE8 properly assigns a class name in the `Element` constructor. [#529 state:resolved] (Riki Fridrich, Andrew Dupont)
diff --git a/src/lang/array.js b/src/lang/array.js
index 7855ad622..62f5f4d87 100644
--- a/src/lang/array.js
+++ b/src/lang/array.js
@@ -8,27 +8,14 @@
  **/
 function $A(iterable) {
   if (!iterable) return [];
-  if (iterable.toArray) return iterable.toArray();
+  // Safari <2.0.4 crashes when accessing property of a node list with property accessor.
+  // It nevertheless works fine with `in` operator, which is why we use it here
+  if ('toArray' in iterable) return iterable.toArray();
   var length = iterable.length || 0, results = new Array(length);
   while (length--) results[length] = iterable[length];
   return results;
 }
 
-if (Prototype.Browser.WebKit) {
-  $A = function(iterable) {
-    if (!iterable) return [];    
-    // In Safari, only use the `toArray` method if it's not a NodeList.
-    // A NodeList is a function, has an function `item` property, and a numeric
-    // `length` property. Adapted from Google Doctype.
-    if (!(typeof iterable === 'function' && typeof iterable.length ===
-        'number' && typeof iterable.item === 'function') && iterable.toArray)
-      return iterable.toArray();
-    var length = iterable.length || 0, results = new Array(length);
-    while (length--) results[length] = iterable[length];
-    return results;
-  };
-}
-
 /** section: Language, related to: Array
  *  $w(string) -> Array
  *  - string (String): A string with zero or more spaces.