alert('<%passtoserver%>');
[download]

So, try this:

    alert('"\""')
[download]

What gets displayed? Same as with alert('"""').

If you are using a templating system to paste values into javascript, then use one that can actually do it correctly, including escaping things that need to be escaped.