gist:6104295

This script:

syscall::open*:entry
/execname == "login"/
{ printf("%s %s", execname, copyinstr(arg0));
ustack(); }

Yields these results (among others):

CPU     ID                    FUNCTION:NAME