It's cat with a string, "cat" doesn't do anything, but "cat __" triggers... the linux cat command is used to view the contents of a file; i'm sure "tail __" will error as well.
bascially that rule is to thwart users exploiting insecure scripts to utilize system commands, they don't want them to cat /var/www/html/config.php (or something similar)...
As i said, it's a really anal module...
