Underhanded launcher

Question

Your goal is to write a super-secret program which launches another (independent) program. You don't have to provide the payload in your answer, it can be any program name your program will launch.

However, the challenge is to keep this behavior a secret. Upon casual inspection of the code, it should be impossible or very hard to notice that your program actually executes a foreign program. Bonus if this "hidden feature", once discovered, can reasonably be explained away as an unintentional bug. This is why the code has to be as clear as possible, and everything should have an alibi for being there, otherwise someone inspecting your code might become suspicious.

Remember, this is not a code-golf, but an underhanded contest.

• Your code has to be clear and readable.
• The causes of the change have to be hidden. Even if discovered, they should look more like bugs than malice.

You should provide an explanation, best in spoiler.

like this

The winner will be selected as the highest voted answer not sooner than 10 days after the first valid answer. _{Yes, I know it's subjective, but this is the only criteria adequate for underhanded contests.}

Voters should value the standard "underhanded" qualities, like how clear the code is and how well hidden the reason is.

_{I made this competition for compiled languages, but you can also use interpreted languages if you find two different notable interpreters for it.}

Answer 1

Tcl

Simple.

proc main {} {
    set fd [open filenames.txt]
    while {[gets $fd line] ne ""} {
        set other [open $line w]
        puts $other [clock format [clock seconds]]
    }
}
main

Ilmari Karonen is right:
If you supply a filename with a | as first character, it will treat the rest as command. IIRC for Perl it has to be at the end.

Answer 2

JavaScript

if(document.location.href = 'http://www.example.com') foo();

"document.loaction.href = 'http;//www.example.com'" sets the page location to "http;//www.example.com" instead of testing for the page location to be "http;//www.example.com".

It's an interpretted language, so here are two interpretters: SpiderMonkey and Google Chrome.