Can you show example code exploiting zsh? I haven't seen such, nor found such:

  » V='() { :; }; echo busted' zsh -c "echo hi"
  hi

But:

  » V='() { :; }; echo busted' bash -c "echo hi"
  busted
  hi

That's incorrect; it does not appear to have the "export function" feature that this bug relies on.