I do not think this is a bug. There are probably thousands of ways to break Postgres by misconfiguring your system, and this is one of 'em.
There is a difference in the behaviour for the WIN32 port. In other platforms execl() is called from "src/bin/pg_ctl/pc_ctl" with the full path ("/bin/sh"), but for WIN32 the function CreateProcessAsUser() calls the CMD command without a path, and this function has a search logic of its own [1].
If even this difference out is of any value I can propose a patch.