“Bottom line: don’t use wordexp(3) on untrusted inputs, even with WRDE_NOCMD.”
wordexp(3) is the usual answer for turning ~/foo into a home directory path in C. Pass the default flags and it runs any $(command) in the string. The WRDE_NOCMD flag meant to stop that fails in musl, which does a perfunctory scan and hands the rest to the system shell. POSIX turned expanding a tilde into command injection by default.