Shell Call Security Disaster

User can supply an argument to this program, say mjd
User gets back finger information for mjd
A casual security analysis says:
- The only nontrivial program that it runs is $FINGER, which is hard-coded
- Finger information is publically available anyway, so this should be safe.
Wrong