premature execution of command substution during tab completion solicitation

[jared r r spiegel]

Configuration Information [Automatically generated, do not change]:
Machine: i386
OS: openbsd4.0
Compiler: cc
Compilation CFLAGS:  -DPROGRAM='bash' -DCONF_HOSTTYPE='i386' 
-DCONF_OSTYPE='openbsd4.0' -DCONF_MACHTYPE='i386-unknown-openbsd4.0' 
-DCONF_VENDOR='unknown' -DLOCALEDIR='/usr/local/share/locale' -DPACKAGE='bash' 
-DSHELL  -DHAVE_CONFIG_H   -I.  -I. -I./include -I./lib  -I/usr/local/include 
-O2 -pipe
uname output: OpenBSD iorek.ice-nine.org 4.0 IOREK.MP#1 i386
Machine Type: i386-unknown-openbsd4.0

Bash Version: 3.1
Patch Level: 17
Release Status: release

Description:
        unexpected execution of incomplete (and currently syntactically 
invalid?)
        commandline by tab-completion subsystem

Repeat-By:
        enter ``"$(echo $RANDOM >/dev/stderr) /dev/null'' a the command
        prompt (with .Dq removed).  note the \" at the beginning of line
        has no matching end quote.  the cursor in my case is directly
        after the last 'l', as if i had just finished typing null, however
        it doesn't seem to be utterly critical to the duplication.

        hit tab a lot.

        my term looks like this:

bash-3.1$ "$(echo $RANDOM >/dev/stderr) /dev/null
20560
nullnull
bash-3.1$ "$(echo $RANDOM >/dev/stderr) /dev/null
26528
nullnull
bash-3.1$ "$(echo $RANDOM >/dev/stderr) /dev/null
13871
nullnull
bash-3.1$ "$(echo $RANDOM >/dev/stderr) /dev/null
18086
nullnull
bash-3.1$ "$(echo $RANDOM >/dev/stderr) /dev/null

        bash is prematurely executing command substitutions inside the open 
quote.
        tested some other unterminated tokens:

" - happens
' - happens
( - appears safe
{ - appears safe

        `command` shows the behaviour same as $(command).

        also duplicated with current bash '3.1dfsg-8' from debian current
        (which has the same $BASH_VERSION string of 3.1.17(1)-release)