Patch 'eval.constructor' bypass

another one bites the dust