Un-Serialising data from a file, without eval

I'm playing with writing data to a file so that it can persist between sessions. I'm using

f.write(data.toSource());

to save my data, where f is my file object, and

var data = eval(f.read());

to get the data back from the file. But that seems like a very insecure way of doing things. Sure it's unlikely that anyone is going to use, AEscript preference files as a backdoor, but that's still just security through obscurity.

Is there a way to read serialised data from a file without using eval()? Or do I have to roll-my-own parser / serialiser to do it safely?