<a href=Presumably this works because the NYT allows access to anyone when they come to an article by following an external link.
I gather this code sets 'http://toys.euri.ca/nyt.js' as the external link for the user's current browser page, i.e., the one the user is looking at when clicking the book-marklet. Nieman Journalism Lab—which the original article linked to—explains how this gets around the paywall.
Apparently when you access the NYT after reaching your limit, the page you want is sent but with an overlay blocking your view of it. Here's the image from Nieman Journalism Lab that illustrates what it says is going on.
The overlay must have code that checks the head of the page to see if the page had been sourced, and if so, it apparently lets you through. So clicking the book-marklet after getting the blocked page sets the page as sourced. Apparently the page is then re-displayed, causing the code that blocks access to allow access.
I'm surprised that the NYT uses such an easily fooled scheme.
H/T to Felix Salmon for the link to the Euri.ca blog.