Although you can use variables within strings in PHP, you can’t do functions. Well, not quite. If your function name begins with a dollar sign ($), it works fine. You can exploit this to call non-object functions such as htmlspecialchars.
<?php
$F = "F";
function F($s) { return $s; }
$filename = '<some code>';
echo "{$F(htmlspecialchars($filename))}";
It’s still not as clean as if you had separated application logic and presentation code like you should have. >:o