Question: Is there any expression where by an object's toString method is **implicitly** called overriding its valueOf method? 

In the examples below, valueOf is always called implicitly (overriding toString).

```
"4" + {
    toString: function () {
        return "4";
    },
    valueOf: function () {
        return 6;
    }
};    // => "46", was expecting "44"

4 + {
    toString: function () {
        return "6";
    },
    valueOf: function () {
        return 4;
    }
};    // => 8

4 + {
    toString: function () {
        return 6;
    },
    valueOf: function() {
        return "4";
    }
};    // => "44"

```

i.e.:

Can we write an expression where by toString is implicitly called over valueOf (i.e without explicitly calling toString)?

Answer: 
> 
> Is there any expression where by an object's toString method is implicitly called overriding its valueOf method?
> 
> 
> 

Yes, that does happen whenever the abstract [`ToString` operation](http://es5.github.io/#x9.8) is applied on an object, using the [`DefaultValue` procedure](http://es5.github.io/#x8.12.8) with `.toString()` before `.valueOf()`.

However, in your examples you have only used the [addition operator](http://es5.github.io/#x11.6.1) which is like an exception from the standard behaviour. Since it does not only concatenate strings, but also sums numbers, it always uses `valueOf` on both operands before checking whether they're strings. See the note 1:

> 
> No hint is provided in the calls to ToPrimitive in steps 5
>  and 6. All native ECMAScript objects except Date objects handle the
>  absence of a hint as if the hint Number were given; Date objects
>  handle the absence of a hint as if the hint String were given. Host
>  objects may handle the absence of a hint in some other manner.
> 
> 
> 

So which operations do implicitly use the `ToString` instead of a hint-less `ToPrimitive`? Here are a few examples:

* Everything about property names: The `in` operator, bracket notation, `Object.getOwnPropertyDescriptor`, `Object.defineProperty`, `hasOwnProperty`, …
* Functions expecting strings as arguments: `parseInt`, `parseFloat`, `encodeURI[Component]`, `decodeURI[Component]`, `[un]escape`, `Array::join`, `String::[last]indexOf`, `RegExp::exec`
* The `Function` constructor
* The `Array::sort` algorithm's default compare function
* The `String` constructor and String methods when casting the `this` object to a string
* The `RegExp` constructor
* The `Error` constructors
* Lots of other functions not specified by EcmaScript but in the DOM or somewhere else, like `alert`, `XMlHTTPRequest::open`, `querySelector`, …
> 
> *Is there any expression*
> 
> 
> 

Yes. Here's an example that will use `toString`:

```
alert({
    toString: function () {
        return "4";
    },
    valueOf: function () {
        return 6;
    }
});  // alerts "4"

```