There's a significant amount of voodoo involved (mostly crazy with() {} statements) in the CS editor that only John Resig fully understands AFAIK, but the rough idea used was to ship the code over to a web worker where all the global APIs it might use were mocked out. This was a relatively short list for KA CS since it's boxed into the processing framework with a few extensions, but would be pretty complicated for full browser environment (probably bordering on impossible). Then we start a timer in the main UI thread, and if the web worker doesn't respond in some amount of time, we kill the web worker and present the error message.

Didn't looked into it but I guess you just need to pass the code as a string to the WW and then use new Function to generate/run the code inside it.