_SAFE, meanwhile, is the second upvalue placed inside any new chunk. It's initial value is a unique userdata with a metatable that defines __call, __pairs, __ipairs, __index, and __newindex as nullops.
Opps -- there's a bug in my spec. __pairs and __pairs should be defined as functions that return nullops, rather than being nullops themselves. I was forgetting how the generic for works :-P
