Couldn't this be a huge security vulnerability used to inject arbitrary commands into a session in FreeSWITCH?

isn't the call authenticated first ? anyway, an option can be added to sip_profile to allow this.

why don't you pass the call to mod_perl or Lua, and do all the
necessary lookups in the script? This shpouldn;t be a big deal to
implement, and much more safe than patching mod_sofia.

not an option, but thanks for suggesting