Allow literal '#' with suppress_eval

I’ve made a PR for this rather than commit direct to master, it could do with another set of eyes over the regex.

If it looks good I’ll merge and cherry-pick into stable.

---
Improve the regex that detects whether an attribute value can be treated
as a literal to allow lone '#' characters. Explicitly check for '#{',
'#@' and '#$'.

Fixes #713