I didn't research this issue further. Create a file 'test.py', and write only 'import shutil'. Then create a file 'copy.py' in the same directory, and write something inside, like 'print ("OH NO")'.

When you run test.py, 'copy.py' is executed, and prints the string. Tested with python 3.5 and 3.6. Works as expected (test.py doing nothing) in python 2.7

I was only able to recreate this under 3.4 and 3.3, and both of them are under "security" status on https://docs.python.org/devguide/#status-of-python-branches

Should this be marked as won't fix?

As per discussion with haypo on irc, this is not a bug since essentially you've made a file which shadows the following stdlib module https://docs.python.org/3/library/copy.html

When shutil goes to import the copy module, your copy module is given higher priority in the import machinery which is why your code gets executed. You can read up more about this here: http://python-notes.curiousefficiency.org/en/latest/python_concepts/import_traps.html#the-name-shadowing-trap

Run "python3 -I script.py" to not insert '' (current directory) at the first position of sys.path.
https://docs.python.org/dev/using/cmdline.html#cmdoption-I

> Run "python3 -I script.py" to not insert '' (current directory) 
> at the first position of sys.path.

That should be "script directory", not "current directory". We only add the current directory to sys.path in interactive mode, and for -c and -m. Adding the current directory to sys.path when running a script would be silly and cause endless grief.