Looks like it works. I guess it is okay that after the close quote the command still runs even though it is not terminated
env x='() { :;}; echo vulnerable' bash -c "echo this is a test"
bash: warning: x: ignoring function definition attempt
bash: error importing function definition for `x'
this is a test
