Object.prototype.toString behaves incorrectly when applied to boxed primitives

[cpcallen]

The following should evaluate to [object String] but in fact evaluates to "Hello":

Object.prototype.toString.apply(new String("Hello"))

Indeed, in general this method should always return a string of the form "[object [[Class]] ]", where [[Class]] is as defined in §8.6.2 of the ES5.1 spec.

This is a generalisation #98—though that bug now also covers other unusual behaviours of arguments.