Difference between EXEC() and sp_executesql with no parameters?
sp_executesql supports parameterisation, whereas EXEC only accepts a string. 

Only performance differences that may arise are due to the parameterisation i.e. a parameterised sp_executesql call is more likely to have a reusable cached plan. An EXEC call is likely to lead to lots of single use space wasters in the plan cache.