Here's the breakdown:

  []["sort"]["call"]()["eval"]

is the same in javascript as

  ([].sort.call()).eval

The part in parentheses calls Array.sort with an undefined this object, defaulting it to window. Array.sort returns this after it's done. Global functions like eval are stored on window, so you end up with window.eval.

Ah. Thanks!

Because [] doesn't have a 'call' attribute, but does have 'sort' attribute (remember that Javascript has a funky object notation, which is why people have to do elaborate dances to iterate over objects), and because the 'sort' attribute of [] itself is an object with a 'call' attribute.