For folks wondering why: this is because a class is (approximately) syntactic sugar for defining a constructor function, and the constructor of a function is `Function`, and calling `Function(string)` is an implicit eval.
John is (approximately) a reference to a desugaring of its `constructor` “method” (which is the term I see used on MDN, I would have expected something more akin to “constructor declaration”; not 100% sure what the spec terminology is and don’t have time to chase it down atm) + its instance members assigned to the desugared function’s prototype. It’s more complicated than that for… reasons.
But the gist is that John.constructor references something other than the constructor defined in the class body, so calling that reference doesn’t call the thing it doesn’t reference at all.
John.constructor("alert('hello')")()
JS has been around a long time. Lots of old stuff hangs around.
Yes, it pops an alert, and no it does not console log.