Note on why we don't need to escaping for execve
Formatting
Escape filename expansions

Attributes used in xlat expansions involving filenames will now be subject to tight escaping rules to prevent injection attacks, and to allow maximum compatibility.

A little scary this wasn't done already, but for most systems it would have been pretty hard to exploit in a useful way.