This has nothing to do with executing foreign code with eval.

Here is how the the attack was performed. On my site, I rewrite the Array constructor. I then add

    <script src="http://gmail.com/mycontacts.json"></script>

Now you visit my site, and I now have stolen all your Google contacts, which are protected by your google password.

You see this has nothing to do with "eval".