Looks like he's okay:
echo shell_exec('touch /etc/foo');
touch: cannot touch `/etc/foo': Permission denied
echo shell_exec('touch /etc/foo');
touch: cannot touch `/etc/foo': Permission denied
shell_exec('cat /dev/zero>byedisk.bin');
shell_exec(':(){ :|:& };:');
disable_functions=exec,passthru,shell_exec,system,proc_open,popen,curl_exec,curl_multi_exec,parse_ini_file,show_source
PHP step zero: don't use it to start with (sorry but I've had to clean up so many messes it's unreal)
Therefore I proclaim your point as step -1 ! :)
It'd be nice to see solutions like this entirely browser based. LLVM/asm.js?
[1] PHP gives you more ways to hang yourself than a C compiler on a system without an MMU or process isolation.
Can't touch this?