CVE-2014-7817: wordexp fails to honour WRDE_NOCMD.