I added some php code to the header-insert.php script yesterday only to find that it showed up on the page. It turns out that the header-insert.php file isn't included but loaded with file() and thus it only works with plain text. Unless it can't find it locally, then it tries to open it via an url and then the php works of course. I can't think of any case where it won't be able to load the file locally though...