A general point here is that the information that I am finding was produced under a charter to “provide enough information to enable useful programs” rather than to be exhaustive in support of providing arguments that there are not security problems. These pointers are nonetheless useful for security exploration for the problems they might reveal. But the following quote seems promising (for JavaScript 1.2):
For a list of all objects and their properties, methods, and event handlers, see “What's in this Reference,” in the JavaScript Reference.
Having skimmed the Predefined Core Objects and Functions, they all seem to be convenience or utility objects. I think they do nothing that the programmer could not do otherwise.
Here is Netscape's list of objects that are automatically available to the JavaScript program when it runs in a browser. Here is a trivial read eval print loop that may reveal which of these objects are actually available in your browser from JavaScript.
What are signed scripts about?
Here is a Core JavaScript Reference for 1.5.