The !say script must be evaluating the contents by doing something like this:
on *:text:!say *:#:{ msg # $eval($2-,2) }
Or:
on *:text:!say *:#:{ scid -r msg # $2- }
Or:
on *:text:!say *:#:{ .timer 1 1 msg # $2- }
They're all poorly written, because all 3 of those evaluate everything passed.
As for your example, using $chr(13) (or $cr) is the very least of your problems. Somebody could use $findfile() to execute mIRC commands.
mIRC isn't to blame for scripter's mistakes.