title: ES2015 template strings security issue
body: <p>Here's a quote from <a href="https://developer.mozilla.org/en/docs/Web/JavaScript/Reference/template_strings" rel="noreferrer">MDN</a>:</p>
  
  <blockquote>
    <p>Template strings MUST NOT be constructed by untrusted users, because they have access to variables and functions.</p>
  </blockquote>
  
  <p>And an example: </p>
  
  <pre><code>`${console.warn("this is",this)}`; // "this is" Window
  
  let a = 10;
  console.warn(`${a+=20}`); // "30"
  console.warn(a); // 30
  </code></pre>
  
  <p>The example here doesn't show any vulnerabilities I can see.</p>
  
  <p>Can anyone give an example of an exploit that takes advantage of this?</p>