String.replace In Console Verses Web Page

I find myself having to dynamically create HTML code, and have found
that the usual way you see to do this is an unreadable mess, like this:

blah('<span id="' + id + '"><a href="' + link + '">' + linkText +
'</a></span>');

So instead, I would like to do something more like the variable
interpolation in Perl and other languages:

blah(XXX('<span id="@id"><a href="@link">@linkText</a></span>'));

The XXX function here would interpolate the values of any variables
named with a @ prefix into the string. Why @? Why not?

So using my favorite JavaScript console (FireBug), I typed the following
and ran it:

x = "hello world";
y = 42;
z = "--@x/@y--"

z = z.replace(/@(w+)/g, function (dummy, v) {
return eval(v);
});

alert(z);

And it works. The alert box shows "--hello world/42--" as expected.
Okay, so now let's turn it into a function:

x = "hello world";
y = 42;

function XXX(s) {
return s.replace(/@(w+)/g, function (dummy, v) {
return eval(v);
});
}

alert(XXX("!!!@x~~~@y!!!"));

And again, it works. The alert box shows "!!!hello world~~~42!!!" as
expected. I should be able now to just drop this *same* code into a
<scriptsection of a web page, right?

Wrong. If I take the *same* code as my second example and plop it in a
web page, the alert does not show the same thing as when in FireBug's
console. It shows the same string passed to XXX, unchanged.

Other experimentation tells me that when placed in a web page, the
anonymous function to do the eval call is never invoked, which suggests
that the regular expression didn't match.

I've only tried this in FireFox 2 and IE 7, but if it doesn't work
properly in either of those, I really don't care about the other browsers.

My guess is there is a difference in the execution environment of
FireBug's console (or likely, any JavaScript console) and the execution
environment of a web page. The questions are what is that difference,
and how do I make my XXX function work properly?