"""
About your subprocess example: we choose to refuse it because we don't 
mix bytes (your non decodable PATH) and unicode ('myapp.sh')
"""
If python3 is doing things right we shouldn't be mixing bytes and
unicode here:

1) the programmer is only sending unicode to subprocess, not a mixture
of bytes and unicode.

2) Python should be converting the arguments to subprocess.call() into
bytes before combining it with PATH, at least on Unix.  The conversion
to bytes is something Python has to do at some point before looking on
the filesystem for the command as filenames are a sequence of bytes in Unix.

Note: your patch for #4036 looks like the right thing to do for the args
argument but as you point out, that doesn't have bearing on the environment.