The above code works because the setTimeout function accepts 2 arguments, the first being a string and the second being an integer.
If you "alerted" the JSstring variable you would get (assuming pos=1) "ScrollIt(1)". It is this final string that will be executed by the setTimeout function, the variable "pos" is not passed to the setTimeout function as a paramater.
var JSstring = "ScrollIt("+pos+")";
Hope that helps.