This is pretty much all covered in the docs for system().

Why does adding a redirect to /dev/null increase the complexity enough to invoke the shell?

Because it's the shell that does the redirection.