That's what's great about this - it is an interpreter which allows the attacker to do absolutely anything, but no non-declared code is directly run.