`ssh $host /bin/sh` (or another shell) should work?
> When a user successfully logs in, sshd does the following:
> ...
> 9. Runs user's shell or command. All commands are run under the user's login shell as specified in the system password database.
But thanks, I've just added another technique to my toolbox.