Bug 774245 - Re-implement moz_bug_r_a4 trickery. r=mrbkap

In the next patch, we drop support for lookupMethod for location objects, since the security policy there is tricky and location objects are already unshadowable Xray wrappers.

browser/components/sessionstore/test/browser_461743_sample.html

@@ -25,7 +25,7 @@
       return flip++ == 0 ? chromeUrl : exploitUrl;
     };
 
-    var href = Components.lookupMethod(frames[1].location, "href");
+    var href = Object.getOwnPropertyDescriptor(Object.getPrototypeOf(frames[1].location), "href").get;
     var loadChrome = { handleEvent: href };
     var loadExploit = { handleEvent: href };