But beware what you interpolate — the command line is executed by the shell!

Yeah, and without any need for that. Using a list of arguments instead of a string would have prevented that. Of course, that would have broken the redirection of STDIN to /dev/null. But that redirection is most times not what the OP wants. You also noticed that:

(Instead of the </dev/null (for no mail body), you could also pipe some message to the command...)

And at this point, we have reached Safe Pipe Opens, with examples that have much less traps than system with an interpolated string and characters that trigger shell invocation.

Alexander