this question is answered in the Sendmail FAQ. Sendmail is using the "sendmail restricted shell", smrsh, which only allows files to be executed which are symlinked from a predefined, restricted path.

p.s. it's great to see a legitimate Anonymous Monk post. i was afraid it would never happen again.