mb_send_mail() and imap_* unfctions allow to access system files.
vulners.com/securityvulns/securityvulns:doc:11633
vulners.com/securityvulns/securityvulns:doc:11642
vulners.com/securityvulns/securityvulns:doc:11643