gistfile1.js

_XMLHttpRequest = XMLHttpRequest;
XMLHttpRequest = function () {
    Object.defineProperty(this,
                          "__onreadystatechange",
                          {value: null,
                           writable: true,
                           enumerable: false});

    Object.defineProperty(this,
                          "onreadystatechange",
                          {get: (function() { return this.__onreadystatechange; }),
                           set: (function(val) {
                                    if (this.__onreadystatechange && typeof this.__onreadystatechange.call === "function")
                                        this.removeEventListener("readystatechange", this.__onreadystatechange);
                                    this.__onreadystatechange = val;
                                    if (this.__onreadystatechange && typeof this.__onreadystatechange.call === "function")
                                        this.addEventListener("readystatechange", this.__onreadystatechange);
                                }),
                            enumerable: true});
}
XMLHttpRequest.prototype = new _XMLHttpRequest();

Do you need to do something like _XMLHttpRequest.call(this) in the "subclass" constructor to initialize anything?

Does it not work as expected? There is no call property on the XHR object:
_XMLHttpRequest = XMLHttpRequest
function XMLHttpRequest() { [native code] }
_XMLHttpRequest.call
undefined