Yes eval is what you need to call, to execute what essentially amounts to dynamically generated script code. The eval() function executes its first argument in the script engine, and (in the case of javascript) returns the value of the last statement in the code. e.g.,
eval("i = 1; i += 1;");
eval("i = 1; 2;");
would each return 2. VBS plays by somewhat more restrictive rules, if you want to eval a chunk of VBS code, it must be a single statement, and it must explicitly resolve to a value. (The resulting value of an assignment does not count.) It's actually somewhat difficult to use eval with VBS code, Exec tends to be more forgiving syntactically, but it does not return a value.
Note that code running in eval or Exec has access to variables declared at the same scope at which either are called, so be careful not to overwrite any data used by the rest of your static code.
Good Luck!
Edit:
The scope in which your dynamic script runs is identical to that at which eval() is called. If it's called from within a function, it has access to variables declared in that function's scope, plus anything declared at document scope. (Don't forget that implicitly declared variables in javascript exist at document scope, even if first referenced inside of a function.)
Note that the string expression passed to eval should look just like regular code when resolved, so this (identifiers shortened to avoid y!a butchery):
eval("alert('obj.firstAtt')");
will display the literal string 'obj.firstAtt' in an alert, because... um... well because that's what it's coded to do. :-) Skip the single quotes if you want the value of that attribute.