Regarding 'ls', I ran "strace ls" on Linux and didn't see any open on /etc/password; it's important that you run 'ls -l', which should trigger the /etc/password access because it has to map UIDs to usernames.
Ah, I'm not familiar with dtrace so I guess I missed that in your comment. Thanks for the clarification.
Understandable. The dtrace command you see is tracing a process "ls" (regardless of switches). I didn't show my work (ls -ld .) that generated the output, so your confusion isn't unfounded. :)