// callableFunctions also includes method names
static O eval(S text, Collection<S> callableFunctions) {
  ret new Eval(callableFunctions).eval(text);
}

static O eval(S text) {
  ret new Eval().eval(text);
}

static Set<S> eval_standardsafefunctions = lithashset("bigint", "compareTo");

static class Eval {
  // safety switches
  Collection<S> callableFunctions;
  boolean allowReadingStaticFields;
  
  new HashMap<S, O> variables;
  L<S> tok;
  new O _null;
  
  *(Collection<S> *callableFunctions) {}
  *() { callableFunctions = eval_standardsafefunctions; }
  
  void setVar(S id, O value) {
    variables.put(id, or(value, _null));
  }
  
  O eval(S text) {
    tok = javaTok(text); // XX: better get from parser
    L e = jparse(text, "exp");
    ret evalExp(e);
  }
  
  O evalExp(L e) {
    // e == [1, 9, "call", "<identifier> ( <explist_opt> )", [1, 3, "identifier"], [5, 7, "quoted"]]
    
    S cl = getString(e, 2);
    
    if (eq(cl, "quoted"))
      ret unquote(get(tok, (int) get(e, 0)));
      
    if (eq(cl, "identifier")) {
      S id = get(tok, (int) get(e, 0));
      O val = variables.get(id);
      if (val != null) ret val == _null ? null : val;
      if (allowReadingStaticFields)
        ret get(getMainClass(), id);
      else
        fail("Unknown variable: " + id);
    }
      
    if (eq(cl, "call")) {
      ret evalCall(e, getMainClass());
    }
    
    if (eq(cl, "methodcall")) {
      L e_exp = cast get(e, 4); // submatch 1
      L e_call = cast get(e, 5); // submatch 2
      
      O obj = evalExp(e_exp);
      ret evalCall(e_call, obj);
    }
    
    throw fail("woot exp: " + structure(e));
  }
  
  O evalCall(L e, O obj) {
    L e_name = cast get(e, 4); // submatch 1
    L e_args = cast get(e, 5); // submatch 2
    
    S fname = get(tok, (int) get(e_name, 0));
    L args = evalArgs(e_args);
      
    ret callMethod(obj, fname, args);
  }
  
  L evalArgs(L e) {
    ret litlist(evalExp(e)); // todo...
  }
  
  O callMethod(O obj, S fname, L args) {
    boolean mayCall = mayCallFunction(fname);
    if (!hasMethodNamed(obj, fname))
      throw fail("Method not defined in " + getClassName(obj) + (mayCall ? "" : ", also not callable") + ": " + fname);
      
    if (!mayCallFunction(fname))
      throw fail("Not allowed to call method: " + fname);
      
    ret call(obj, fname, toObjectArray(args));
  }
  
  boolean mayCallFunction(S fname) {
    ret callableFunctions.contains(fname);
  }
}

Began life as a copy of #1002385