Chris Ries requested changing the call to system to execv, but NSTask is just as good.
In AppDelegate.m change the call to system to either NSTask or execv. URLs could have spaces which would be a potential vulnerability. Here is an example of NSTask:
NSTask *task = [[NSTask alloc] init];
task.launchPath = @"/Library/Internet\\ Plug-Ins/JavaAppletPlugin.plugin/Contents/Home/bin/javaws";
task.arguments = @[url];