I tested Postfix 2.7.1-1 (Debian) and none of those work as you described.
cat is not executed. (And to be honest, I can't imagine any possible reason why would
sendmail execute an arbitrary part of its argument just because it happens to say "
Sure, if you
sendmail process, you might see the file
open()ed, but that's completely normal:
sendmail is querying the real name of your account, in order to fill the
From: header correctly.
strace does not show any calls to
exec*(), except for the one that launches
If you still believe this is a bug,
try a completely unrelated file instead:
fstab is something that normally would never be read.
sendmail is not a shell alias or function:
$ type sendmail
sendmail is /usr/sbin/sendmail
And update Postfix.
(yes, it's old, but still...)
Never complain about bugs in old software versions unless you have confirmed that they are present in the absolutely latest version too.