2.1.3 [ECMA-262/5] Section 11.4.3, The typeof Operator
The specification states:
Table 20 – typeof Operator Results lists the strings returned when the production UnaryExpression : typeof UnaryExpression is evaluated. When the type of value is: Object (host and does not implement [[Call]]) The result is: Implementation-defined except may not be "undefined", "boolean", "number", or "string".
IE9 Mode, IE10 Mode, and IE11 Mode (All Versions)
"object" is returned for all host objects, including those objects that do not implement [[Call]].