This is not a bug. /timer evaluates the command in question when the timer fires. You have to sanitize your data before passing any use input to /timer. If you want it to be $chr(35) $+ $me that's how you should pass it into the timer command.

Code:
alias lol timer 1 1 msg $replace($1,$,$!!) lol


There are other (better) ways to sanitize /timer commands, and there are a few safe_timer command variants out there (check these forums/hawkee/mircscripts.org). Maybe someone will post the snippet here.

There's really nothing else mIRC can do in this situation. There is no way for /timer to know that $1 is a channel name-- not everything starting with # is an irc channel, and even if it did, there's no way to know that the user does not want $1 to be evaluated. It's up to you as the scripter to handle this case.

- argv[0] on EFnet #mIRC
- "Life is a pointer to an integer without a cast"