However, wordexp(3) is also dangerous! That last 0 argument is for the flags parameter. By default, all expansion features are enabled, including command expansion: