ps | less | grep blah
less uses fstat
It says "Oh no, my standard output is a pipe!"
Then it execs /bin/cat (or just pretends to be cat)
Problem solved