because creating a function using a string is the same as using

    new Function("code");

which makes use of eval() for the code