Message formatting: handle unexpected case of failing property lookup.

test/mjsunit/regress/regress-crbug-523308.js

Index: test/mjsunit/regress/regress-crbug-523308.js
diff --git a/test/mjsunit/regress/regress-crbug-523308.js b/test/mjsunit/regress/regress-crbug-523308.js
new file mode 100644
index 0000000000000000000000000000000000000000..5715762ed6b57e98c45e551fa6483bd8e5501a34
--- /dev/null
+++ b/test/mjsunit/regress/regress-crbug-523308.js
@@ -0,0 +1,10 @@
+// Copyright 2015 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+var error;
+try { reference_error(); } catch (e) { error = e; }
+toString = error.toString;
+error.__proto__ = [];
+assertEquals("ReferenceError: reference_error is not defined",
+             toString.call(error));