... the "just eval it" approach to JSON does give me the shivers. Do people really do that in AJAX?

For the most part: yes they do. Two reasons:

1. it's by far the fastest way to "parse" complex data structures in javascript (though eval()ing very large strings in IE is still slow).

2. you'll only receive the data from your own server anyway (can't access any other server via XMLHTTP), so you can already make sure the data is in the desired format on the server side.