Hrm. Though I agree it's important to security conscious, I'm not sure I see the problem here. 

In this instance, if a user creates a style named "toString", the worst thing that would happen is the user overwrites a method on the Object class for the cache, but as the cache is very short-lived (i.e., no longer than this function call), and we never expose the object to other functions, and never use any methods off it, no harm can be caused by this.

The point of user input is actually when they are creating a new common style, or when the document is loaded. In both these instances, the right thing would be to rename the style, preserving the display name (e.g., toString becomes odf_toString, and display name becomes toString).