got rid of a call to the Function constructor by replacing it with a call to evalInSandbox (Javascript code in Load URL/Script actions runs now in a restricted sandbox)