The awesome Soroush Dalili has broken JSReg again, he is like a one man sandbox breaking machine. I’m very grateful for his work as he makes JSReg much stronger. All bypasses where mistakes in how I implemented the $eval$ function inside JSReg, the outer engine would filter the code correctly however when the $eval$ function was used it would fail to parse the code line by line and remove comments.
Bypass 1
eval("xn/nalert('Bypassed - similar to the first one');window.parent.execTag();n//");
Bypass 2
eval("//nwindow.parent.execTag()n//");
Bypass 3
eval("/**/nwindow.parent.execTag()n/**/");
Bypass 1 was fixed by parsing line by line inside of the eval, bypass 2 & 3 where fixed by stripping comments from eval.
Thanks again Soroush!