[Exim] timeout_frozen_after and system_filter

Whilst experimenting with exiscan, I've come across a slight oddity (which
AIUI has nothing to do with exiscan). I couldn't find anything relevant in
the archives.

Environment: Solaris 8, Exim 4.10, Exiscan 4.10-16

A msg has been frozen by exiscan.
auto_thaw is unset.
The msg has subsequently been timed out by timeout_frozen_after.

In exim_mainlog we get

2002-10-14 10:12:54 Start queue run: pid=29019
2002-10-14 10:12:54 1811D2-0007Xu-00 cancelled by timeout_frozen_after
2002-10-14 10:12:54 1811D2-0007Xu-00 cancelled by system filter: This
message .... etc
2002-10-14 10:12:55 1811HS-0007Y5-00 <= <> R=1811D2-0007Xu-00 U=exim
P=local S=2493

From the spec:-
a bounce is sent to the sender, in a similar manner to cancellation by
the -Mg command

However, cancelling a message with -Mg gives

2002-10-14 10:55:06 1811wI-0007Yt-00 Message is frozen
2002-10-14 10:55:34 1811wI-0007Yt-00 Unfrozen by forced delivery
2002-10-14 10:55:34 1811wI-0007Yt-00 cancelled by exim

What concerns me is that the system filter is run in the first case. In
our situation this was harmless (it just rejected the msg because of an
undesirable .extension), but in general it might do something more
constructive (a.k.a. destructive!)

It seems to me that the system filter should not be run, as no delivery
attempt is made (or is it?)

Is this a bug or not? I'd like to think it is; that would make two I've
found in Philip's software in less than thirty years ;-)
(Anyone else remember ZED?)

Regards,
Richard Hall