I would think this is a security violation. What if I put a script 'which' in my $PWD? This 'which' script could execute anything - even something potentially dangerous. By specifying the path to the binary itself, I would eliminate that one risk.