WooYun.org

var HashListener = {
	...
	init: function(c, a) {
		//函数a监听hashc的变化
		this.onHashChanged = a ||
		function() {};
		...
	},
	...
}
HashListener.init("/static/ui/history.htm",
	//初始化HashListener,PageMgr.loadHistory就是监听hashchange的函数
	function(c) {
		PageMgr.loadHistory(c)
	});
PageMgr.loadHistory = function(call) {
	var script = decodeURIComponent(decodeURIComponent(call));
	if (script != this.currentSrc) {
		try {
			//动态执行
			eval(script);
			this.currentSrc = script
		} catch(ex) {
			console.log(ex);
			return false
		}
	}
	return true
}