I suppose its possible, but the most likely case is just an unhandled exception. JSON does not support string literal notation for values which means in practice any function you replace won't be callable. I suppose someone more clever than I or more likely better motivated could combine this attack with another to do some harm.

Having said that, use underscore for the safe references.