As you've written it, both are equally "safe". The safety issue comes up when you try to pass arguments, because there is a temptation to do things like this:
setTimeout('func('+arg+')', 100);
Which has the potential for code injection. Someone will use it to destroy your death star. Sooner or later, a young jedi will figure out how to trick your app into making arg
equal to 3.14); deathStar.selfDestruct(
, and next thing you know, you're getting a call from the Emperor to explain your mistake.
And it might not be you who makes the mistake... you would never do anything so foolish. When your code gets refactored 6 months later by the intern and they need to add an argument, that's when the problem comes.
So the string form is just considered bad practice. It's slower, and potentially less safe.