When safe_mode is enabled, exec()-like calls are still done with the webserver uid, letting users execute any server scripts owned by 'www' (for example).

In the case that php_safe_dir = /usr/local/phpexec:

# chmod 700 /usr/local/phpexec
# chown www.www /usr/local/phpexec

inside i put the following sh script:

#!/bin/sh
#
echo `id`

Now i log in as user 'veins', make a php script with the following:

<? exec("/usr/local/phpexec/id.sh", $value, $return);
   echo $value[0]; ?>

when i go to  ~veins/id.php  i get the following:

uid=67(www) gid=67(www) groups=67(www)