Using EXEC - Dynamic Search Conditions in T-SQL
As I’ve already mentioned, EXEC() is an inferior solution to sp_executesql and the CLR. The reason for this is that since EXEC() does not take parameters, you have to build a query string with parameter values interpolated. This precludes query plans from being reused. It also makes the programming more difficult. Nevertheless, there are three situations where you need to use EXEC() or at least interpolate parameter values
Source: www.developerfusion.com