gistfile1.js

function F(){}
Object.defineProperty(F.prototype, 'foo', { 
  get: function(){ return F._foo; }, 
  set: function(value){ F._foo = value; } 
});

var obj = new F();

obj.foo; // undefined
obj.foo = 1;

obj.foo; // 1 (setting works as expected here, but let's freeze an object)

Object.freeze(obj); // now we shouldn't be able to change object's values, since it's frozen. However...

obj.foo = 2;
obj.foo; // 2

/*
This happens because freezing object only sets OWN properties to be read-only, 
so properties defined as accessors on the prototype chain — even though looking 
like regular properties — are not affected. This is what happens in IE9pre4 
with host objects, where properties like "className", "title", etc. on elements 
are defined as accessors on prototypes; as a result, `Object.freeze`'ing elements 
does not make those properties read-only (contrary to what happens in Chrome, btw).
*/