Why is a replacement callback safer when untrusted replacement text may contain dollar si…

Why is a replacement callback safer when untrusted replacement text may contain dollar signs?

1. The callback returns literal text instead of letting the replacement-template mini-language interpret `$&`, `$1`, or `$<name>`.
2. The callback automatically makes the regex linear time.
3. The callback changes UTF-16 indices into byte offsets.
4. The callback validates every captured value semantically.