Unfortunately, mIRC's default aliases.ini and popups.ini files make use of the #$ construct, which means removing support for it would cause most people's aliases and popups to break. So even if you could argue that it ought to be removed for security reasons (which I personally would agree with), I don't think it's practical to remove it.
As far as double evaluating timers go, I'd like to see a switch to make the timer not evaluate when triggered (similar to $read "n" switch). I'd be surprised if this has never been suggested though, so perhaps I am overlooking something.
