This isn't a useful answer for you at all, but I thought I'd mention that there are "kind of" innocuous eval()'s such as Angular's eval() [1] where instead of JS being evaluated (which can lead to nasty things), an Angular expression is evaluated, which is a bit safer.

Obviously what I've just said doesn't help solve any problems here, but thought I'd throw it in there anyway :)

[1] https://docs.angularjs.org/api/ng/type/$rootScope.Scope#$eva...