The thing with prototypes, is that you can do reads all day long from them, and it wont change the underlying structure of what is pointing to what. However, the first time you do an assignment, you are replacing, on that instance, what that property points to.
In your case, you didn't actually reassign the prototyped property, you modifed the value of the underlying structure that was found at in that property.
What this means is that all objects that share a prototype of A actually share the implementation of A. That means any state carried in A will be found on all instances of B. The moment you do an assignment to that property on an instance of B, you have effectively replaced what that instance (and only that instance) points to (I believe this is due to the fact there is a new property "name" on B that gets hit in the scope chain, before it reaches the "name" implementation on A).
EDIT:
To give a more explicit example of whats going on:
B.prototype = new A();
var obj1 = new B();
Now, the first time we do a read, the intepreter does something like this:
obj1.name;
Interpreter: "I need property name. First, check B. B does not have 'name', so lets continue down the scope chain. Next up, A. Aha! A has 'name', return that"
However, when you do a write, the interpreter doesn't actually care about the inherited property.
obj1.name = "Fred";
Interpreter: "I need to assign to property 'name'. I'm within the scope of this instance of B, so assign 'Fred' to B. But I leave everything else farther down the scope chain alone (i.e., A)"
Now, next time you do a read...
obj1.name;
Interpreter: "I need property 'name'. Aha! this instance of B has the property 'name' already sitting on it. Just return that - I don't care about the rest of the scope chain (i.e. A.name)"
So, the first time you write to name, it inserts it as a first class property on the instance, and doesn't care anymore about what is on A. A.name is still there, it's just further down the scope chain, and the JS interpreter doesn't get that far before it found what it was looking for.
If "name" had a default value in A (as you have, which is "A"), then you would see this behaviour:
B.prototype = new A();
var obj1 = new B();
var obj2 = new B();
obj1.name = "Fred";
alert(obj1.name); // Alerts Fred
alert(obj2.name); // Alerts "A", your original value of A.name
Now, in the case of your array, you never actually replaced list on the scope chain with a new array. What you did is grab a handle on the array itself, and added an element to it. Hence, all instances of B are affected.
Interpreter: "I need to get the 'list' propery, and add an element to it. Checking this instance of B ... nope, does not have a 'list' property. Next in the scope chain: A. Yep, A has 'list', use that. Now, push onto that list"
This would not be the case if you did this:
obj1.list = [];
obj1.push(123);