While its certainly easier to use brackets/parenthesis around @sqlstring don't forget about sp_executesql.

declare @sqlstring nvarchar (255)

set @sqlstring = 'use ' + 'master' + ' dbcc showfilestats'

execute sp_executesql @sqlstring