Actually, this particular example wouldn't invoke a shell ...

Right. But the next logical step will probably cause both invoking a shell and opening a security hole:

Depending on the beginners experience, the call may change to system("import -window root $filename") (very naive) or system("import -window root '$filename'") (a little bit of experience, but still wrong).

With a proper multi-argument system() (i.e. system('import','-window','root','MyScreenshot.png')), it is very unlikely to happen. We may see some cargo cult, like putting the filename in quotes (system('import','-window','root',"$filename")), but that does not cause any problems (except perhaps some wasted CPU cycles).

And for extra bonus points, the import utility would be called with an absolute path, to avoid the dependancy on $ENV{'PATH'}. That would also save a lot of CPU cycles trying to find import.

Alexander