php-imap -- imap_open allows to run arbitrary shell commands via mailbox parameter

The PHP team reports: imapopen allows to run arbitrary shell commands via mailbox parameter...