This is an archived snapshot of W3C's public bugzilla bug tracker, decommissioned in April 2019. Please see the home page for more details.
Probably too late for current meeting, but it just occurred to me whether it would be beneficial to include fn:transform and fn:load-xquery-module as part of that feature. They are new XPath 3.1 functions that dynamically run a stylesheet or dynamically load an XQuery module. They are therefore "in the same league" as dynamic evaluation and also from usability standpoint, they exhibit the same security vulnerability issues. I think it makes sense to switch them all on or off and that this can be tested as for xsl:evaluate with the same (or separate?) system-property names.
Noted that both these functions have error codes defined to say "No suitable XSLT/XQuery processor available", and this can happen for a wide variety of reasons, e.g. that some administrator has configured the system to disable dynamic use of external XSLT/XQuery processors; these errors can be caught using try/catch. At this stage of the game, this seems an adequate workaround.