Eval+reentry (eval arbitrary code read from PUSHTX) is what…
Eval+reentry (eval arbitrary code read from PUSHTX) is what could cause exponential blowup. Maybe you could do the same static analysis we do for SCALL but I shudder to think how that would look in bitcoin script...