From a quick grep in the sources:

grep escapeshellcmd * -r

core/phpmailer/class.phpmailer.php:      $sendmail = sprintf("%s -oi -f %s -t", escapeshellcmd($this->Sendmail), escapeshellarg($this->Sender));

core/phpmailer/class.phpmailer.php:      $sendmail = sprintf("%s -oi -t", escapeshellcmd($this->Sendmail));

so it seems the culprit is in the phpmailer code.

Hopefully, we can get rid of that class in the near future...

Still not fixed in 1.1.6 !!!

And I doubt we will fix this in 1.1.x, because replacing phpmailer is a too risky change on the stable branch

if you are having this issue, you can workaround it by using one of the alternative mail methods.

Have added a check for this case to check.php

If phpmailer method is sendmail and escapeshell* is disabled, throw up an error.

Paul