Even if the regex are sanitized to removed Perl code, they are still dangerous. It is fairly easy to produce pathological regular expressions that won't finish in the age of the universe and take all the CPU to process.

This results in a denial of service attack. The server would need to have some way to kill off matches if they run for too long.