If he can get a reference to the window or 'this' at any point (which I haven't yet figured out), he can presumably use his string-building tricks to build the string "alert", then use:

    window["alert"]("hello")