Allow literal '#' with suppress_eval

Improve the regex that detects whether an attribute value can be treated
as a literal to allow lone '#' characters. Explicitly check for '#{',
'#@' and '#$'.

Fixes #713