More realistically, it also fails if you have directories on your path that are symlinks to other directories in the path. In that case their programs are doubly-counted.
Anyways, if your PATH is malicious then you have worse problems than this silly script :)