Agreed. Running eval on untrusted input is a recipe for disaster!

Using Taint would be a very good idea, although I'm not sure how you'd make a regex that correctly extracts a regex :-)