Close security issue in !!js/function constructor.

Prevent it from code execution on parsing.
Thanks to @nealpoole for report.