Why did assignment affects instance and not prototype attributes?

That's just the way the language is defined. From the spec:

The production MemberExpression : MemberExpression [ Expression ] is evaluated as follows:

1. Let baseReference be the result of evaluating MemberExpression.
2. Let baseValue be GetValue(baseReference).
3. Let propertyNameReference be the result of evaluating Expression.
4. Let propertyNameValue be GetValue(propertyNameReference).
5. Call CheckObjectCoercible(baseValue).
6. Let propertyNameString be ToString(propertyNameValue).
7. If the syntactic production that is being evaluated is contained in strict mode code, let strict be true, else let strict be false.
8. Return a value of type Reference whose base value is baseValue and whose referenced name is propertyNameString, and whose strict mode flag is strict.

That Ecma moon language does not include any mention of looking for properties on object prototypes. An l-value member expression always refers to a property on the base object directly involved.

Using "this" you cannot assign anything to the prototype but you can read from it. So when you do this.hobbies = x; you set the property "hobbies" of the current instance rather than that of the prototype, which then hides a prototype-level property of the same name (i.e., boy.hobbies does not longer return the array from the prototype because there is a direct property with this name).

concat() returns a new array rather than a reference to the existing one and hence, you're hiding the prototype-level property "hobbies".

At the next call, the instance-level array "hobbies" is then overwritten by a new one containing the previous values plus the new one.

Whenever you set the value of a property of an object, the property is defined on the object itself, no matter if the property exists in the object's prototype chain or not.

This is described in the specification, section 8.7.2:

4. Else if IsPropertyReference(V), then
     (a) If HasPrimitiveBase(V) is false, then let put be the [[Put]] internal method of base, otherwise let put be the special [[Put]] internal method defined below.
     (b) Call the put internal method using base as its this value, and passing GetReferencedName(V) for the property name, W for the value, and IsStrictReference(V) for the Throw flag.

The [[Put]] method is described in section 8.12.5, where the important step is:

6. Else, create a named data property named P on object O as follows
     (a) Let newDesc be the Property Descriptor {[[Value]]: V, [[Writable]]: true, [[Enumerable]]: true, [[Configurable]]: true}.
     (b) Call the [[DefineOwnProperty]] internal method of O passing P, newDesc, and Throw as arguments.

If you look closer at the specification you will see though that the assignment will only create the property on the object if the inherited property is not an accessor property.

I.e. the following will actually not create an instance property:

var name = 'foo';

function User() {} 
Object.defineProperty(User.prototype, 'name', {
    'get': function() { return name;},
    'set': function(val) { name = val;}
});

var u1 = new Users();
var u2 = new Users();
u1.name = 'bar';
console.log(u2.name); // shows 'bar'
console.log(u1) // shows 'User {}' instead of 'User {name: 'bar'}'

As for me, this is not the best example of Prototype enheritance.

Thats you example, modified by me:

function User() {
     this.hobbies = [];
};
    User.prototype = {

        addHobby: function (x) {
            this.hobbies.push(x);
        }

    };

boy = new User();
girl = new User();

boy.addHobby("swimming"); 
girl.addHobby("running");