Triggers eval / Function constructor / Function.apply sinks from iast_js_execution. Prime taint, then execute.
iast_js_execution
Taint is taken from ?payload or the textarea when you click "Prime taint sources".