Ruben Ventura (@tr3w_) found a pretty cool bypass of MentalJS. He used insertBefore with a null second argument which allows you to insert a node into the dom and bypass my sandboxing restrictions.
more here.........http://www.thespanner.co.uk/2015/03/06/mentaljs-dom-bypass/
more here.........http://www.thespanner.co.uk/2015/03/06/mentaljs-dom-bypass/