Doesn't this mean executing an arbitrary code on another person's computer? You could send a javascript object over network rather than some json data and then glue it with the code on the client side too (this is what google does/did with the search suggestions at some point).