Every object has an internal property known as [[Prototype]] that carries a reference to another object, known as its prototype. When the JS interpreter is unable to find a named property in the object's own members, it looks for them in the object's prototype, then the prototype's prototype, and so on until it reaches Object.prototype, the lowest prototype of every object, which has no [[Prototype]] itself.
The [[Prototype]] property is assigned the value of the constructor-function's prototype property by the new operator. So when you call new Person the new object receives [[Prototype]]= Person.prototype. When you create a function, it gets a new, empty object for its prototype property, but you can reassign the constructor-function's .prototype completely as well as writing new members to it.
However the [[Prototype]] property remains the same through the life of the object; in particular, whilst adding new members to the Person.prototype makes them visible in all Person instances, assigning a new object to Person.prototype does not change the prototypes of existing Person instances.
Normally, [[Prototype]] is an invisible implementation detail. But in Mozilla, the [[Prototype]] internal property is exposed under the public __proto__ property. This non-standard extension has been adopted by Opera, Safari and Chrome, but not IE. In general it is considered poor form to rely on.
In ECMAScript Fifth Edition, you will be able to fetch the [[Prototype]] value using the new function Object.getPrototypeOf(person). Browser support is poor so far.