I like it. Here's a slightly more stable version. But still not crazy about using eval on arbitrary code. O.O

     function render(tpl,data){
          return tpl.replace(/{([^\}]+)}/g,function(_, key) {
              try { return eval("data."+key); }
              catch (e) { return ""; }
          });
     }