User-triggered code execution via relative Notepad path

Untrusted search path handling in SumatraPDF 3.5.2 and earlier allows local users to execute code through Advanced Options. In AppTools.cpp, the handler launches notepad.exe by name instead of resolving the SystemRoot binary, allowing Windows to select an attacker-planted executable from the application directory. Exploitation requires a malicious notepad.exe in that directory, Notepad as the default text editor, and a user to open Advanced Options; code runs with the current user's privileges.