Allowing user-defined rules comes to mind. AFAIK `eval()`-ing user input is can't be done in a safe way. Probably OK on browser but not on the server.
> Probably OK on browser but not on the server.
Probably OK on someone else's machine but not mine? :-p
I don't see why a language like JS couldn't be used for evaluating rules when sandboxed. Looks like there's a project that does just that: https://developers.google.com/caja/