Removing the backtick in the dirname should fix things, I'd think.
I imagine if you were to create a .html file, test`me.html & try to "execute" that, you might see something similar.
And it is sh that is throwing the error, so I wouldn't think that an attempt to sanitize things on the FFS would be of any help.