Earlier quoted context omitted.
To substitute variables in a localized error message template.
Does generating that substitute value imply launching a shell command?
No. But template expression language used in Struts is quite expressive. :) There's some defensive system to prevent access to arbitrary classes, but the attacker managed to overcome it in a clever way.