although this projects seems orphaned, I found a minimum working example. It is all about return values of procedures called in the Tcl main loop:

/tmp$ tclsh
% package require tclreadline
% ::tclreadline::Loop
tclsh8.5 [/tmp]after 1 {apply {args {return oops}}}
tclsh8.5 [/tmp]
invalid command name "oops"
while evaluating oops
tclsh8.5 [/tmp]

The result of apply is written into the line buffer. I guess that Expect is even more vulnerable there ...