I don't know how the JavaScript proposal does it, but you can certainly create generic clone structures that are safe for untrusted input.