Steps to reproduce:

1. create JS step for example:

   var macro = "{#VALUELENGTH}";
   if (!/^\d+$/.test(macro)) return "Invalid #VALUELENGTH macro";
   if (value.length == macro.length) return "OK";
   return "The value has "+value.length+" characters.";
   

1. Inject javascript code. Return something completely different with a MACRO:

   "; return "Fire in the server room! Activate sprinklers and evacuate immediately!"; \\

1. The extra objects helpful for injecting something else (send HTTP request, etc...):
   https://www.zabbix.com/documentation/current/en/manual/config/items/preprocessing/javascript/javascript_objects