(For completeness, can't remember if this got mentioned recently.)
The distribution of specs, background, and reference implementation of
Safe-Tcl is in <ftp://ftp.ics.uci.edu/mrose/safe-tcl/>. A couple of
lengthy papers about the language design included are recommended
reading for anyone wishing to design a safe language for active
documents.
-- Marc VanHeyningen <http://www.cs.indiana.edu/hyplan/mvanheyn.html>