in reply to Re^2: read HTML <title> tag
in thread read HTML <title> tag

The eval'ed side of the replacement expression should be filtered when user input is used you are correct, however you example far from a successful injection