Whether this is a bug or a (mis)feature is open for some debate, the
shell imports all variables so why not import IFS? $PATH also influences
Solaris 2.x login will filter IFS and other environment variables, but
"su" and other don't filter it, so using /bin/false as only protective
measure is not sufficient for denying local attacks.
Solaris 2.next /bin/sh will no longer import IFS from the environment.