Because it's (relatively) easy to validate (if you're going to) a simple identifier (ignoring UTF-8 issues and that $ can be in an identifer, I'd almost conside

Because it's (relatively) easy to validate (if you're going to) a simple identifier (ignoring UTF-8 issues and that $ can be in an identifer, I'd almost consider it matching ^\w+$ to be enough), and it's increasingly harder to properly validate javascript expressions without actually having a javascript interpreter and parsing/executing it. More complexity means an incrase in the possibility of bugs and more divergent implementations.