[Mimedefang] javascript in address header

[kd6lvw at yahoo.com]

--- On Wed, 3/20/13, Joseph Brennan <brennan at columbia.edu> wrote:
> Ever see one of these?--
> 
> To: Joe B <jb51 at columbia.edu<javascript:_e({},> 'cvml','jb51 at columbia.edu');>>
> 
> I changed the name and address, but otherwise this is what ...

Since when is JavaScript valid in SMTP headers?  Is there even a proposal (i.e. an RFC) that suggests this?  I see no reason to reject this on sight as a malformed mailbox in a header.