Well, it's well known that being able to freely set certain environment variables is a disaster. That any variable regardless of its name should have such an effect is, however, news.
You can talk all you want about unrelated gotchas in shells & security, and that's missing the point.
You can talk all you want about unrelated gotchas in shells & security, and that's missing the point.