I updated your fiddle ( http://jsfiddle.net/8AQM9/33/ ), as you said, event.target is read-only, but we can overwrite the property descriptor with Object.create .
You were on the right track, but Object.create does not extract only the hash of the key: value file, it returns key: property-descriptor , you can see in MDN as a property descriptor.
I replaced
Object.create(e, { target: document.createElement('p') });
WITH
Object.create(e, { target: { value: document.createElement('p') } });
And this will be the prototype e and will change the target property of the new object.
source share