- Functions can't be used as a prototype, and you can't do new Function(anotherFunction), so you can't "clone" a function unless you reliably have access to its source code(!!).
- While accessing the source code to a function is possible, accessing the scope it was defined in is not. So, you still can't "clone" a function reliably.
- There's no import statement. Good luck writing re-usable code. There are workarounds (e.g. XMLHttpRequest + eval, document.write("..."), etc.), but all are pretty hackish and don't work everywhere all the time or don't get cached by all browsers.
- No coroutines, continuations, generators, threads (please don't!), or equivalent. That means implementing iterators, cooperative multitasking, or anything else asynchronous is only slightly more fun than a good caning.
- When they can't block a browser indefinitely, the user gets a stupid "Do you want to terminate this script?" modal dialog. Regardless of the user's choice, they probably have to terminate the process anyway.
- alert() is a modal dialog, which means that if the script invokes it repeatedly fast enough, you have to terminate your browser's process. Of course, there really isn't a better way to get debugging output.