Also the "undefined behaviours" used for fingerprinting and denying access to non-mainstream UAs even if they have JS support. If I remember correctly, YouTube was doing something like that.