I spent a while looking at it last night and came up with a solution, I'll walk you through it. For reference, here's the code:

    function escape(s) {
      // Bonus level!

      Object.defineProperty(console, 'foo', 
         { get : function() { throw 'nooo!' } });

      var code = 'with(window.console && console.foo || {}) {\n\t'+s+'\n}';
      console.log(code);

      try {
        console.log(eval(code));
      } catch (e) {
        console.log(e);
      }
    }

The idea is, you need to craft `s`, such that `s` can execute arbitrary code without throwing 'nooo!'. The interesting problem is, any access to `console.foo` with throw because the getter above is called. This includes the access inside the `with` statement. So the solution, if there is any, must somehow cause mutation of state before the `with` even executes.

Now, what brought me to the solution was this thought: "What in Javascript allows you to execute code before a given statement?" Upon framing it in this way, the solution became immediately clear: function declarations are automatically hoisted!

If you redefine `console` to be an object without the property 'foo', the `|| {}` part of the with predicate will instead be passed as the scope, and you have free reign to walk about the system.

So the solution is:

    alert(1) } function console(){} {

Which produces the statement:

    with(window.console && console.foo || {}) { 
      alert(1) } function console(){} {
    }