Don't concatenate tainted strings in JS.  Fixes #1976.