code: function() {
      new Function(arguments[arguments.length - 3]).apply(null,
          (function(args) {
            var realCallback = args[args.length - 1];
            var unwrapperCallback = args[args.length - 2];
            Array.prototype.splice.apply(args, [args.length - 3, 3]);
            args.push(function(result) {
              unwrapperCallback(result, realCallback);
            });
            return args;
          })(Array.prototype.slice.apply(arguments, [0])));
    }
docs: When running in Firefox chrome mode, any DOM elements in the script result will be wrapped with a XPCNativeWrapper or XrayWrapper. We need to intercept the result and make sure it is "unwrapped" before returning to bot.inject.executeAsyncScript.  The function below is in terms of the arguments object only to avoid defining new local values that would be available to the script via closure, but we know the following to be true: let n = arguments.length, then arguments[n - 1] -> The "real" async callback. This is provided by the bot.inject.executeAsyncScript atom. arguments[n - 2] -> Our "unwrapper" callback that we give to the user script. This is injected via an argument because it needs access to variables in this window's scope, while the execution context will be selenium.browserbot.getCurrentWindow(). arguments[n - 3] -> The user script as a string. arguments[0..n - 3] -> The user supplier arguments.