Wasn't the conventional wisdom to never feed raw input into `eval`?

Oops.