The shell will never look at it, so it’s possible to store the payload there. The only trick, then, is to find the end of the script and, thus, the start of the payload. Consider this file ...