There is no way to be sure it can't be ever referenced:

  function frame() {
    var str = "blah";
    return function() {
      eval("console.log(str)");
    }
  }

Edit: updated to use eval instead of setTimeout because setTimeout(string) do not share the scope.