In short, don't use read-eval at all if you want safe reading. Use the clojure.edn alternatives to read data safely in those circumstances.
;; The particular issue of executing arbitrary Java constructors used
;; in the examples above no longer works in Clojure 1.5 when
;; *read-eval* is false. Even so, you SHOULD NEVER USE
;; clojure.core/read or clojure.core/read-string for reading untrusted
;; data. Use an edn reader or a different data serialization format.
Result:
user=> (binding [*read-eval* false] (read-string "``````````x"))
OutOfMemoryError Java heap space clojure.lang.RT.cons (RT.java:570)