It doesn't run actual code. The function call syntax is just for extensions like `!vault` in Ansible YAML. And yes, it is supposed to be a new JavaScript subset and JSON superset.