I remember sending fake Yahoo login forms as html attachments. eval() & alert() fix:
`const ev = 'ev', al = 'al', ert = 'ert'; window[ev + al](window[al + ert]('hi'))`
`const ev = 'ev', al = 'al', ert = 'ert'; window[ev + al](window[al + ert]('hi'))`