I know this is off-topic, but you can use eval(String.fromCharCode(XX, XX, XX, etc)) to run arbitrary JavaScript, even if quotes are escaped.
Imagine the case where he had not escaped quotes, but had escaped < and >. In that case, I could put a doublequote/singlequote to break out of the JSON. Then I could just put whatever javascript I wanted and run it.
But that is true, trying to filter specific character sequences for example, "eval" is never a good idea.