Sure, you can shoot yourself into the food in various ways. 
What I thought of was more like the following:
A utility module env.js
module.exports = {
isBrowser: function() {
return typeof window !== 'undefined' && typeof document !== 'undefined';
}
};
console.log('document: ', typeof document);
console.log('window: ', typeof window);
And some app.js
// globals.document = {}; globals.window = {};
// or
// require('/some/malicious/module/which/alters/globals');
var env = require('env.js');
console.log('isBrowser: ', env.isBrowser());
As long as you don’t add some globals manipulating code before requiring env.js, it should be “safe”.
Assigning the return value to a variable called window only affects the module scope.
Another interesting approach is this http://www.timetler.com/2012/10/13/environment-detection-in-javascript/
I did not expect such a “trivial” problem to be unsolved yet. I bet node.js and io.js will come up with a safe solution, when isomorphic code gets more relevance.