Or, conversely, everyone here is confusing eval() with evaluation in general. JSONP does not call eval() as such, but it does evaluate the server response as JavaScript, because it ends up as:

    <script src="/whatever?callback=foo"></script>

The source of which is something like

    foo({"a":"b"})

Therefore, the hash supplied to foo() must be valid JavaScript.