> The conclusion doesn't offer any advise what should be done instead of eval.

In case anybody is actually wondering, you almost always want a Function constructor:

    var add = new Function('arg1', 'arg2', 'return arg1 + arg2;');

The only exception I've ever run into was in miniature string templating where eval or with was used as a hacky way to generate the context. The best way to do that is replace with a function argument:

    tmpl_str.replace(/{{(\w+)}}/g, function(_, key) { return ctx[key]; })