the $string might contain arbitrary code such as @{[system "rm -rf /"]} which would be executed as a result of the interpolation process.

Heh, that's mocking shell, not C, and really caught me off guard for a moment before the d'uh bells went off.

Makeshifts last the longest.