As I mentioned before, $function should be validated as a static callback (string or array with len = 2, both strings). Anything other should throw an exception. 

FYI we're hoping to move WS to a plugin for 1.9 and I'd looove to get rid of this eval(), which was added 5+ years ago, probably just from not knowing about call_user_func.