While in this case we're probably safe because this code path is
for embedding users and thus aren't going to be subject to code
injection attacks, we'll still going to fail if the argument
contains shell metacharacters.

Fix that by using g_spawn_async() which doesn't go through /bin/sh.
Tested compilation, not at runtime, but should work.