diff --git a/src/libcore/cell.rs b/src/libcore/cell.rs
index d644fd0063ed34ae24d4e552665e3f36d407108d..8a4b9f6e51b60bef2cec0cf3714d826bbc540277 100644
--- a/src/libcore/cell.rs
+++ b/src/libcore/cell.rs
@@ -191,6 +191,17 @@ pub fn set(&self, value: T) {
             *self.value.get() = value;
         }
     }
+
+    /// Get a reference to the underlying `UnsafeCell`.
+    ///
+    /// This can be used to circumvent `Cell`'s safety checks.
+    ///
+    /// This function is `unsafe` because `UnsafeCell`'s field is public.
+    #[inline]
+    #[experimental]
+    pub unsafe fn as_unsafe_cell<'a>(&'a self) -> &'a UnsafeCell<T> {
+        &self.value
+    }
 }
 
 #[unstable = "waiting for `Clone` trait to become stable"]
@@ -306,6 +317,17 @@ pub fn borrow_mut<'a>(&'a self) -> RefMut<'a, T> {
             None => fail!("RefCell<T> already borrowed")
         }
     }
+
+    /// Get a reference to the underlying `UnsafeCell`.
+    ///
+    /// This can be used to circumvent `RefCell`'s safety checks.
+    ///
+    /// This function is `unsafe` because `UnsafeCell`'s field is public.
+    #[inline]
+    #[experimental]
+    pub unsafe fn as_unsafe_cell<'a>(&'a self) -> &'a UnsafeCell<T> {
+        &self.value
+    }
 }
 
 #[unstable = "waiting for `Clone` to become stable"]
diff --git a/src/libcoretest/cell.rs b/src/libcoretest/cell.rs
index b3ae110363cb56e357ddcf3adfded634a6673cda..59365045f43807cfb027c02fe3df316e92cdf289 100644
--- a/src/libcoretest/cell.rs
+++ b/src/libcoretest/cell.rs
@@ -127,3 +127,22 @@ fn clone_ref_updates_flag() {
     }
     assert!(x.try_borrow_mut().is_some());
 }
+
+#[test]
+fn as_unsafe_cell() {
+    let c1: Cell<uint> = Cell::new(0u);
+    c1.set(1u);
+    assert_eq!(1u, unsafe { *c1.as_unsafe_cell().get() });
+
+    let c2: Cell<uint> = Cell::new(0u);
+    unsafe { *c2.as_unsafe_cell().get() = 1u; }
+    assert_eq!(1u, c2.get());
+
+    let r1: RefCell<uint> = RefCell::new(0u);
+    *r1.borrow_mut() = 1u;
+    assert_eq!(1u, unsafe { *r1.as_unsafe_cell().get() });
+
+    let r2: RefCell<uint> = RefCell::new(0u);
+    unsafe { *r2.as_unsafe_cell().get() = 1u; }
+    assert_eq!(1u, *r2.borrow());
+}