1) that's a far less likely scenario 2) you shouldn't be running programs out of publicly writeable directories on hostile multiuser systems anyway.

3) (not directly related to your post) explicitly using ./ allows for more accurate completions, almost always making up for the two extra characters typed (particularly since ./ is so easy to type with a single motion).