roundcube/roundcubemail — pull request #67 by andywer (2013-04-05 10:12:03+00:00)
Title: Replaced nasty eval() code #2

New fix, now doing what it's supposed to do.
I did the create_function() approach you suggested for evaluating the expression.

I also check that the expression does not contain any manual function calls (i.e. "file_get_contents('/etc/passwd')") using a regex.