I don't get it. His first example is that since the string replace method takes a callback as its second argument, you can use it to run code. So if you happen to find an app that injects unescaped user input into Javascript, you could enter the string alert(1)".replace(/.+/,eval)// and have it run the alert.

But if the app is injecting unescaped user input into code, wouldn't a simple ";alert(1);// achieve the same thing? Why do you need to be tricky?

The examples seem to be based on the premise that web apps commonly forgo the simple escaping of quotes, and instead implement a complex parsing and analysis of user input as code to identify malicious statements, which can be defeated as long as you obfuscate enough.