redefine native browsers function in Firefox from userscript space

Question

with code below in FireFox native function can be redefined (in Chrome you could just do document.func = newfunc or just the same thing as below but without injectind code), injecting can be allright for small new functions, but if it is needed to communicate with other functions or variables in the userscript it would be necesarry to inject the whole code of userscript,

so I'm looking for a way to override\redefine\etc a native function in FireFox from UserScript's space without injecting.

// ==UserScript==
// ==/UserScript==

function doh4x()
{
    window.history.__proto__.pushState = function(a, b, url) {window.location.href = url;}
}

function inject(func) 
{
    var source = func.toString();
    var script = document.createElement('script');
    script.text = "("+ source +")()";
    document.head.appendChild(script);
}

inject(doh4x);

Answer 1

Use unsafeWindow

---

unsafeWindow.history.__proto__.pushState = function (a, b, url) {
    window.location.href = url;
};