Erm, if you pass a list they call execvp(3) directly rather than starting up a shell. If there's one argument but it doesn't have anything more exotic than whitespace it's split and passed to execvp rather than run through a shell. See the exec and system entries in perlfunc; or look under the hood at pp_system in pp_sys.c and Perl_do_exec3 in doio.c.

Update: this is only on fork-available /bin/sh-having OSen I believe; I can't speak to what unnatural machinations are done elsewhere as my eyes started to glaze over with some of the #ifdef'ing going on.