The path walker: follows a Flight reference one key at a timeDecks: the chunk's own keys, Object.prototype, FunctionFlight references are colon paths, resolved one key at a time. Nothing kept the walk to the chunk's own keys, so $1:__proto__:then reached Object.prototype.then and $1:constructor:constructor reached the Function constructor, which then ran attacker source while the fake thenable resolved. React 19.0.1, 19.1.2 and 19.2.1 stop the walk at own properties.