Hacker News Reader

It means it can bypass any automatic "javascript filters" which try and filter out malicious js code while allowing legitimate code.

so does any eval'd code

Unless eval is special-cased to get the evil bit set.