Depending on the ground rules that you set, I don't think eval() or Function() would be that bad considering they both evaluate in the global scope and you're w

Depending on the ground rules that you set, I don't think eval() or Function() would be that bad considering they both evaluate in the global scope and you're working with strings in the first place. My first guess for the chopping block would be the functionality of franken-objects like Function.arguments (especially properties like arguments.callee).