Really an attacker controlled system() call?!?