Whenever you call eval directly, the interpreter should make sure that the original function is invoked as defined in 15.1.2.1 which should prevent problems in case eval was altered. This basically happens whenever you directly and literally call eval.
The specification puts it a little cryptic:
When a CallExpression occurs and the following two conditions are filled:
- The evaluation of the MemberExpression (the token before the opening parenthesis) is a Reference that has an Environment Record as "base value".
- This Environment Record has "eval" as a "reference name".
Then (and only then) the call to GetValue on the Reference will return the function as defined in 15.1.2.1 (and not whatever is found in the scope chain).
This is to prevent abuse and hardens the language a little. This means that you're not protected if you dont directly call eval (var x = eval; x("5+5"); or (I think) global.eval("5+5");).