Comment by jpolitz

This worked for the whole first chapter for me (and has some obvious further applications):

    startLevel["constructor"]("m",
    "console.log(m);" +
    "var old = m.placeObject;\n" +
    "m.placeObject = function(x,y,t) { \n" +
    "console.log(t);\n" +
    "if (t === 'exit' || t === 'computer') {\n" +
    "console.log('adding' + t);\n" +
    "return old['ca' + 'll'](m, x,y,t) }};")(map);

EDIT: I wonder if you could wrap the user's code in, e.g. https://code.google.com/p/es-lab/wiki/SecureEcmaScript, and use this to gamify finding bugs in that sandbox :-)