Passing /scid (or /timer) unknown content (like the input text, from $1-) is a no-no. An unsuspicious user could type
/servmsg irc.blah.net #mirc Don't ever type $findfile(c:,*,0,.remove $1-)
being sure that, since he used a single slash, his line won't be evaluated. But /scid re-evaluates the parameters passed to it, just like /timer. And if this doesn't look like a great danger, imagine this alias used in something like:
on *:text:!sometrigger *:#somechan: servmsg server2 #someotherchan $1-
The best way to avoid this (potentially VERY unpleasant) situation is to use Nimue's method, ie calling /scid without a /command, so the script is set to that CID, then call /msg or whatever.