Whenever you have a timer or scid or /scon (and more) and unknown data, because of the double evaluation, you must use $unsafe to avoid injections

Here $chan could be used to evaluate identifiers via #$identifier.

Code
on *:TEXT:*Hello*:#:{
  if (!%no_reply1) {
    .timerAUTOREPLY 1 $rand(2,5) msg $unsafe($chan $nick $+ $chr(44) Hi dude!)
    set -u600 %no_reply1 $true
  }
}

#mircscripting @ irc.swiftirc.net == the best mIRC help channel