K5 exec in search bar ?

Hi there,

does anybody know how it was possible to run shell script as user "framework" in the early Touch version in the search bar? It makes of course sense that some kind of escape character was used, but which one???
Furthermore, do you know which firmware update fixed this security hole?

Thanks in advance!