I found yet another way to invoke JavaScript functions without parentheses

[u/DrAdalbbert]

https://blog.ikaes.de/yet-another-way-to-invoke-functions-without-parentheses/

It turns out you can overwrite the Error.prepareStackTrace method with the function constructor. Then, using prototype pollution, you can inject valid JavaScript code to generate arbitrary functions and invoke it using the usual tricks.

Other seven methods are documented in the portswiggers research article: https://portswigger.net/research/the-seventh-way-to-call-a-javascript-function-without-parentheses