Objects in javascript are passed by reference when you get the object from flow or global context it is exactly the same object (your variable is simply a reference to the original)
If you wish to have a new clone that doesn't affect the object, there is a helper function RED.util.cloneMessage() you can use to make a copy before modifying it.
e.g...
var obj = RED.util.cloneMessage(flow.get("obj") || {});
The helper function takes care of special cases. Also, i don't think the serialisation to string is performed in the helper function so should be faster / safer.