UserAgent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/62.0.3202.75 Safari/537.36

Steps to reproduce the problem:
1. Follow example here at https://developer.chrome.com/extensions/devtools#selected-element. 
2. See how commandline API scope (like $_ and $0, and so on) can be accessed by the function `setSelectedElement`, which is defined only in a content script scope, when that function is called by `devtools.inspectedWindow.eval`, passing in variables like $0, from commandline API scope (inspected page execution context), with the `useContextScriptContext` flag true.
3. Consider what is going on. 

What is the expected behavior?
I do not know the internals of how this works, but it seems to me that, in order for $_ or $0 ( or others ) to be accessible to the function, then they have to be accessible within the content script context, somehow.

What went wrong?
This could be a security issue, but probably isn't, because I simply don't understand the internals.

Did this work before? N/A 

Chrome version: 62.0.3202.75  Channel: stable
OS Version: 10.0
Flash Version: 

Feel free to point me to the relevant place in the source code that explains how this execution works, if I'm mistaken about this being some issue. I don't think it would be a security issue because this is one of those "intersections" where security is obviously a thing and people would have already thought about it. Just in case there was something, and as a chance for me to learn, I'm submitting it.