Throw when passed strings on Object.prototype

[EvanHahn]

Because 'constructor' in Object.prototype, status('constructor') would return Object.prototype.constructor. This was true for any all-lowercase key, which is currently __proto__ and constructor.

Here's the meat of the change:

-  var map = {}
+  var map = Object.create(null)

[dougwilson]

Unfortunately this object is a public API, so changing the prototype within the same major version is going to be painful. Can we implement the same behavior with something like Object.prototype.hasOwnProperty instead?

[EvanHahn]

Updated with a new utility function, getOwn. Let me know if you'd prefer something lighter-weight.

[dougwilson]

Thanks @EvanHahn ! I updated the PR to perform the check on all the lookups as well, so they are all guarded now as appropriate.