although this projects seems orphaned, I found a minimum working example. It is all about return values of procedures called in the Tcl main loop:

/tmp$ tclsh
% package require tclreadline
2.1.0
% ::tclreadline::Loop
tclsh8.5 [/tmp]after 1 {apply {args {return oops}}}
after#0
tclsh8.5 [/tmp]
invalid command name "oops"
while evaluating oops
tclsh8.5 [/tmp]

The result of apply is written into the line buffer. I guess that Expect is even more vulnerable there ...