Segfault when invalid object is passed as "this" to Array.prototype.join

// Works fine with a normal array
Array.prototype.join.call([0, 1]);

// Works fine with this array-like object:
Array.prototype.join.call({
  "length": 2,
  "0": 0,
  "1": 1
});

// Invalid, but will not cause a segfault
Array.prototype.join.call(function(){});

// Will cause a segfault
Array.prototype.join.call(0);
Array.prototype.join.call(null);
Array.prototype.join.call(true);
Array.prototype.join.call();