When is an eval not at least a security "code smell"?