$read and /timer were used in the original script and both evaluate their contents. If the events were defined with a wildcard channel match instead of static text $chan would also need to be sanitized when passed to the timer.
http://en.wikichip.org/wiki/mirc/msl_injection
