popen(), but worse. The child calls execvp(), which calls malloc() a bit more than execl(), and it calls non-library functions that call malloc() and who-knows-what else (stdio is called in at least some error cases).