Object virtual call

Main.java

public class Main {

  public static void main(String[] args) {
    Object a = new VulnerableClass();
    a.toString();
  }
}

class VulnerableClass {

  void vulnerableMethod() {

  }

  @Override
  public String toString() {
    vulnerableMethod();
    return "pwned";
  }
}

class HarmlessClass {
  @Override
  public String toString() {
    return "";
  }
}