Or, alternatively, only allowing dot-delimited [valid identifier names](http://mathiasbynens.be/notes/javascript-identifiers), that we can then translate to `window["{{identifierPart1}}"]["{{identiferPart2}}"]`, etc. These will still need to be escaped, of course.