There's plenty of schemes that aren't fully standards-compliant but I don't think leaving out eval is common -- it's easy to implement and nothing about the standard says that it needs to run code fast.

Just wanted to point out that eval is the real static vs dynamic boundary. As to evil, sure, you shouldn't run just any code you find without having a sandbox in place, C's way to do the same thing is to call cc followed by dlopen, that's way scarier, which is why people just link in lua or something instead. I guess in you should probably include a wasm runtime instead of using dlopen.