JSON isn't a strict subset of JS. Moreover, no, you should never eval() things which are untrusted. Do you really trust everything the browser tells you? No? Then why trust JSON?

I'm not anti-JSON, I'm anti-JS. Browsers don't support other languages (except for VB, which bites, and Fx nightly support for Python, which I wish would become more widespread) so there's no choice in a browser. On the server side, though, you have a chance to use real languages, so you really should.

Oh, and also, you do know that XML-RPC, bless its ill-specified heart, is still around, right? There's a whole world of enterprise that isn't prepared to accept JSON-RPC.