Beware device references without shell escaping