`addJS` doesn't escape the JS code

[NotWearingPants]

The JS code is not escaped, so something like:

pdf_writer.addJS(r'app.alert("\x41");')

will alert x41 instead of A.