There WAS such an issue generally with PHP installed as CGI: a query arg like ?-s would be passed as a command line -s switch to the PHP interpreter spawned. http://www.php-security.net/archives/9-New-PHP-CGI-exploit-C...
I remember reading an article in 2600 where someone figured out that quite a few websites took a PHP filename as a query arg to be eval'd... and some subset of those had no mechanism in place to restrict it to local files. Needless to say, they could point that arg to example.com/malicious.php and have it run on the vulnerable box.
The best part was that they constructed a Google query to find sites that would eval remote PHP code. It was something else!