Reviewers are probably taught what to look out for. In this case, training is the vulnerability.
Seems like a single occurrence of "eval" should both fail that automatic review AND be blocked by default in all browsers using default security settings.
I think this just shows that ad networks shouldn't be using js at all. Just dumb images. (Yes I know, no tracking then which makes it useless yada yada - deal with it)
You're not wrong, but there are difficult customers with money to consider.
In google's case I can see the conflict - they both make a browser and live off ads. But apart from that minor issue I don't see why browser vendors don't just block "eval()"?
(Also, they have started blocking flash, thank god - so maybe this will all be a thing of the past soon)
My point is: online ads should become what bus stop ads have always been. You buy a space and display a dumb image. Did it work? You have to do your own A/B testing in half the city. What was it worth? You have to trust those you buy ad space from on how many people read their paper or pass by their bus stop.
Edit: Wikipedia article explains - you can call functions by name with that "filter" thing.
This should be pretty easily blockable though - if you block "eval" then just block most of the obscure jsfuck constructs too.