RE: The evaluate function

Apart from all the issues mentioned by Mr.Kay, an eval()
function makes it rather easy to open security holes in
a style sheet.

For example, once you figured out you can put a XPath into
the nice "Enter your query here" field which is passed
directly to an eval() function, what will stop you from
entering document("file:///C/Documents and >Settings/Administrator/preferences.xml")?

Or, if extension functions may be called indiscriminately:
 mswin:delete("C:\*.*","recursive")