gistfile1.py

#!/usr/bin/env python
#
# Run the program, then type this in when it asks for your name:
#
# os.system('say hello')
#

import os
name = eval(input('Enter your name: '))
print('Hello, {}'.format(name))

It can also be done without the import os line in the source if the malicious code is written as:

__import__('os').system('say hello')

The reason this can do anything is that command sent to os.system are passed directly to the shell, which can read (cat), create (touch), and remove (rm) anything on the computer that you have access to.